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Privacy Commissaire 
Commissioner a la protection de 
of Canada la vie privée du Canada 


The Honourable Gilbert Parent 
The Speaker 

The House of Commons 
Ottawa 


July 1997 


Dear Mr. Parent: 


I have the honour to submit to Parliament my annual report which covers the. 


period from April 1, 1996 to March 31, 1997. 


Yours sincerely, 


Bruce Phillips 


Privacy Commissioner 


The Year at a Glance 


April 1996 


May 
® 


Appearance before House of Commons Transport Committee on Bill C-20, 
privatization of Air Navigation System (page 33) 

Canada Post photocopying competing courier mail (page 45) 

Commissioner responds to Solicitor General's DNA databanking 


paper (page 24) 


Canadian Privacy Commissioners meeting, Victoria, B.C. 

Health Canada files found in Winnipeg dumpster (page 46) 

Information Highway Advisory Council report calls for framework privacy 
legislation by the year 2000 | 

CDMA endorses government plan for private sector law 


June 


Census Day 

House of Commons Committee on Human Rights and Status of Persons 
with Disabilities Roundtable on privacy and new technologies (page 29) 
Appearance before Senate Committee on Transportation & Communications 
on privatization of Air Navigation System 

Cabinet orders local telephone companies to make customer databases 
available to competing directory publishers (page 37) 

Appearance before House of Commons Justice and Legal Affairs Committee 
on operations 

Pilot match begins of all returning air travellers’ customs declarations with 
employment insurance database (page 7) 


July 


CRTC licences first Personal Communications Systems (page 38) 


August 


Uniform Law Advisory Group on Protection of Personal Information 
considers comprehensive data protection law 

Federal Court rules against access to Canada Labour Relations Board 
members’ notes (page 40) 


September 

e Justice Minister commits Canada to private sector privacy law at 18" 
International Privacy and Data Protection Commissioners Conference, 
Ottawa (page 76) 

e Appearance before House of Commons Finance Committee on review of 
financial institutions White Paper 

e Ontario Human Rights Board of Inquiry rules major corporation's substance 
testing program unlawful 


October 

e Appearance before Standing Committee on Procedure and House Affairs on 
permanent voters list (page 19) 

e First complaints against Customs-HRDC match 

e Tax audit documents found in cabinet bought at government surplus store 


_ (page 44) 


November 

e Appearance before Select Committee on Law Amendments, New Brunswick 
Legislature on proposed privacy bill 

e¢ Canada Post debiting credit cards for unordered merchandise (page 45) 


December 
e CRTC announces hearings on costs of unlisted phone numbers 


(page 38) 


January 1997 
e HRDC asks Office to review Labour Market Initiatives with Indian Bands 


February 

e Appearance before Special Joint Committee on a Code of Conduct for MPs 

e National Forum on Health final report calls for national health information 
database (see page 14) 

e Appearance before Sub-committee on Firearms Act regulations (page 21) 


March 

¢ Human Rights Committee holds cross-country hearings on privacy and 
technology 

e Reported to Transport Canada on Air: Navigation System files (page 49) 
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On the One Hand... 


Paradox. (n.) person or thing having contradictory qualities. 
— The Oxford Dictionary. 


YA 


The 'thing' in this case is the Government of Canada. Paradox pertectly 
describes the contradictory and confusing behaviour demonstrated in the last year 
in the field of privacy rights. Some of the most hopeful and encouraging 
developments in a decade have run parallel with some of the most disturbing and 
dangerous. 


We have seen both a growing recognition of the pressing need for stronger and 
more comprehensive laws to protect Canadians’ privacy rights—and we have 
witnessed actions which threaten to make a shambles of those rights. Which will 
triumph? 

Thumbs up 

On the positive side, nothing equals in importance Justice Minister Allan Rock’s 
pledge that, by the year 2000, there will be federal law to provide "effective, 
enforceable protection of privacy rights in the private sector". The government. 
recognizes that technology has made it all but impossible to maintain effective 
privacy protection without covering both the public and privates sectors. 


This Office has long advocated such a step. And it has the endorsement of the 
government's own Information Highway Advisory Council, the Canadian Direct 
Marketing Association, the Information and Privacy Commissioners of Quebec, 
Ontario and British Columbia, to mention only a few. Let us hope that some 
vestiges of our privacy remain to be protected by the millennium. 


Curiously, the Minister’s announcement drew only passing mention in the 
media. I say ‘curiously’, given the generally first-class record of Canadian media 
in keeping abreast of privacy issues, and because this was the most significant 
statement of government privacy wahoe since the passage of the Privacy Act itself 
in 1983. 


Similarly overlooked was a landmark study by the House of Commons Standing 
Committee on Human Rights chaired by the Hon. Sheila Finestone. This 
committee devoted the better part of a year to the study of privacy rights and 
new technologies, visiting several cities and hearing from scores of witnesses 
representing every shade of opinion. 


In April, as the House was rising for the election, the committee released its 
report, Privacy: Where do we Draw the Line? The report is nothing less than 
breathtaking both in its scope and depth. What distinguishes it from earlier 
reports is its recognition of privacy's fundamental value to Canadian society and 
not a "token to be bartered for social and economic benefits". One committee 
member describes privacy as an "associative" right—one that ts essential to free 
association, free speech, and to our very autonomy. The report offers a guide for 
grappling with one social and ethical impact of the new technologies. 


Mr. Rock could do no better than to merge this committee's work with that of 
the Information Highway Advisory Council (which focuses on the consumer and 
business case for privacy on-line) and the Canadian Standards Association's model 
privacy code as the outline for his promised new privacy law. 


The document deserves far more than the scant public attention it received. As 
the movie critics say, Two Thumbs Up! 


Another important Parliamentary development was the Commons’ unanimous 
endorsement of a private member's motion (Mr. Paul Créte, Kamouraska, 
Riviére-du-Loup) to extend the existing Privacy Act to cover all Crown 
corporations, a step advocated both by this Office on more than one occasion, 
and by the Commons Justice Committee in its 1987 review of the Privacy Act. 
Here was a clear expression by all parties in the House which, although not law, 
is both a strong direction to the government and clear indication of Members’ 
growing awareness of the rising public concern over privacy intrusions. 


The government also has responded at last to our repeated pleas to stop the 
erosion of privacy rights as it prunes its bottom line. Transforming government 
operations into an array of not-for-profit bodies, commercialized monopolies and 
“competitive companies was depriving their clients and employees of legally 
established privacy rights. 


After some hesitation, during which air traffic control operations were 
transferred to a private company (NAV CANADA) absent those rights, a new 
policy is promised which will continue Privacy Act protection for newly 
privatized agencies. We applaud the promise and anticipate its arrival. 


Finally, we welcome the growing practice among government departments to 
seek our comment and advice on specific proposals or plans which have privacy 
implications. Our last report drew attention to a successful collaboration with 
the Chief Electoral Officer to ensure protection and respect for Canadians' 
privacy rights in the new permanent electronic voters register. 


Other major information users too, Statistics Canada and Human Resources 
Development Canada (HRDC) among them, have sought our input in major 
undertakings. HRDC, in particular, is examining several projects, one of 
which—a common client identifier akin to a universal identification 
number—literally bristles with privacy implications. Some of these proposals 
represent a major test of the theory that technology and privacy can co-exist. 
We will follow them with care and concern. 


Government departments are not obliged to consult the Privacy Commissioner. 
But it is hard to conceive of a more useful application of staff expertise and 
insights than helping government departments achieve their policy and 
management objectives in ways that respect the rights of Canadians. Mrs. 
Finestone's committee recognized the value of this consultative function and 
recommended making it part of the Office's official mandate. 


If the tale could end here, the year would have been one marked by steady 
progress. But life seldom proceeds so smoothly. 


...On the Other 


Attention now turns to a practice which poses a deadly threat to privacy and to 
its corollary—autonomy and personal freedom. It has led us into a head-on 
collision with two great departments of government, HRDC and Revenue 
Canada, precipitating a legal challenge which may ultimately determine whether 
privacy is a fundamental value of this society or merely an irritant quickly to be 
consigned to the scrap heap of unfulfilled good intentions when the going gets 
tough. 


That issue is data matching, an innocent-sounding activity with the capacity to 
demolish any real right to privacy and certainly to destroy the basis of trust 
which must exist between citizens who provide, and governments which collect, 
personal information. 


Given the intense pressure on government departments to be leaner (and, if 
necessary, meaner) coupled with the alluring ease of tracking citizens with 
computers, a confrontation was probably inevitable. 


At issue is HRDC’s practice of collecting data from the Customs declarations of 
every returning air traveller to identify employment insurance claimants who 
were out of the country while receiving benefits. EI claimants must report any 
extended absence from their normal residence for the good reason that they are 
expected to be looking, and available, for work. HRDC officials (and many 


taxpayers) have long been troubled by anecdotal evidence—approaching an urban 
legend—that many claimants were enjoying holidays at taxpayers’ expense. The 
department's administration and enforcement methods were allegedly proving 
ineffective. 


HRDC conceived the notion of matching the EI data base with that of returning 
travellers customs declarations. The match would quickly show whether any of 
those millions were receiving employment insurance payments. It would then be 
a simple matter to find whether they had reported their absences. 


Doubtless such a match will catch some who may be cheating EI. But the price 
it exacts is far too high. It systematically searches millions of innocent travellers, 
without their knowledge or consent, who filed customs returns on the 
assumption—and on Revenue Canada’s word—that they would be used for 
customs purposes only. 


The match offends the most fundamental principle of any privacy law; that 
government tell its citizens why it is collecting personal information, then use it 
only for that—and not a wholly unrelated—purpose (unless the individual 
consents). The reason for the principle is clear: to prevent the government from 
conducting unwarranted surveillance on its citizens by prowling through its 
immense personal databanks on what amounts to nothing more than high- tech 
fishing expeditions. 


Let us try a pre-computer age analogy. Assume there are some criminals at large 
in your community. Assume that the police therefore embark on a search of 
every single household, without warrant, without notice, without permission, 
and without any cause to suspect any particular household. The police just show 
up, barge through the door, and look around. How long would any community 
accept such arbitrary behaviour? 


Yet, in an information context, that is precisely what data matching makes 
possible—a systematic search of everyone. Governments which match data this 
way have turned the presumption of innocence on its head; everyone is suspect 
until the computer proves them innocent. It is akin to what an earlier privacy 
commissioner described as “high technology search and seizure”. If we allow 
government to carry on in this fashion, they will routinely scrutinize every 
record of every citizen until they unearth some evidence of guilt. 


A privacy commissioner cannot accept a data search that ignores the presumption 
of innocence, the need to identify some reasonable grounds for suspicion, and the 
absence of independent authorization. If such matches become standard practice, 


we face virtually open season on any personal information we entrust, or are 
forced to deliver, to government. 


Unable to convince bureaucrats, or their ministers, to modify the match, we 
sought legal advice from one of Canada's leading constitutional experts. His 
advice buttressed our position that the data match violates the search and seizure 
provisions of the Canadian Charter of Rights and Freedoms. We are currently 
exploring with the government the most expeditious n manner of getting the 
matter before the Courts for resolution. 


No more crucial issue has arisen in my six years in this Office. I have no more 
interest in protecting UI cheats from detection than the next taxpayer. I have 
every interest in preventing government from putting millions of law-abiding 
Canadians under "dataveillance". As a people and a society, we enjoy Charter 
protection against having to prove our innocence. One's Charter rights should 
not be compromised simply because technology makes it possible. 


The premise of this match is boundless—once entrenched, we are on the slippery 
slope to a general surveillance system in which personal data from all levels of 
government are routinely shared and matched. 


A recent letter from Mr. Whyte of Toronto, argues that the practice "opens the 
door to abuse of information power of government" and urges citizens to resist. 
While this match may seem "reasonable and popular", he argues that it could 
establish a precedent for government to use customs information "to determine 
which citizens have travelled to a country whose policies they may oppose, 
whose trade they may wish to restrict, or for any other purpose.... Travel 
information is routinely used by autocratic regimes to restrict and control their 
citizens. We must not allow this precedent to be established in Canada. This 
match must be resisted as a routine protection of our liberty. I urge you to stop 
this misuse of customs information." 


The Information "Panopticon" 

In effect, such a match is an electronic version of late 18'" century philosopher 
Jeremy Bentham's Panopticon. Bentham proposed a design for a prison which 
would allow guards to observe prisoners from a central tower from which they 
could see out but no-one could see in. The tower might, or might not, be 
occupied but the effect of his design was to create "a state of conscious and 
permanent visibility that assures the automatic functioning of power". Effective 


but chilling. 


Technology now furnishes government with the power to create an information 
Panopticon. Why should it not seize the advantage? Perhaps we would all 


behave impeccably—or, at least, differently—if we thought someone might 
observe our every transaction. There is no underestimating the power of fear 
and embarrassment for social control—hence the loss of our autonomy. But we 
must not concede to the bureaucrats that our society is so manifestly corrupt that 
we must subordinate our rights of individual autonomy and privacy to their 
interests in efficiency. 


Well, you say, I have nothing to hide so what does it matter? Sometimes an 
individual's right has to give way to the interests of society as a whole. 


Perhaps that is where we are losing our way. It's time to consider the damage 
that the unfettered exercise of power can inflict on our society. By concentrating 
on privacy as an individual right, we then are forced to play the game of "this 
right trumps that one—my right as a taxpayer not to be ripped off trumps your 
right not to be under surveillance". 


It may be time to consider the view, espoused by Priscilla Regan in her book 
Legislating Privacy, that considering privacy as an individual right does not serve 
a strong basis on which to develop public policy. We should consider privacy's 
social importance; its inherent place as a bedrock value in a democratic society 
and understand how it influences our relationships with one another, with social, 
political and economic organizations, and what powers we are prepared to grant 
these organizations. 


Protecting our privacy is not simply a matter of debating the value of an 
individual's self-interest versus a competing interest. Privacy also serves a 
common, public and collective interest. The value strengthens our society by 
reinforcing our sense of connection through mutual respect. 


Whatever we do to protect privacy, we must recognize the import of the value 
and the consequences to our liberty if we are lazy enough—and short-sighted 
enough—to consider it an administrative nuisance that gets in the way of 
efficiency and the bottom line. This is the path to the Surveillance Society. 

I urge the government not to take it. 


Nothing to Hide—and Nothing to Prove 


Characterizing the options governments are now considering as the path to a 
surveillance society is far from overstatement. Granted Canadians view 
governments generally as benign—part of our fortunate heritage. Geography and 
climate require our governments to have a social conscience, reflected in our 
social safety net. But funding and benefitting from that safety net do not mean 
abdicating our civic responsibilities, one of which is to ensure that we do not 
sacrifice individual choice and personal liberty at the altar of efficient 
government. . 


Governments now have the means for tracking virtually all their residents' 
contacts with the state, assembling comprehensive data bases from that data and 
sharing it widely. And with the means come the pressures—downsize, rationalize 
and deliver service more efficiently. Some of this information collection is a 
legitimate activity of a government programa "consistent use" of the data. 
Some, we find disturbing. And one, we argue—matching returning travellers 
customs declarations with the employment insurance database—is so broad as to 
be an unreasonable search and seizure under the Charter. 


This year's report examines just a handful of the past year's developments: the 
Revenue Canada Customs/Employment Insurance match, proposals for a single 
cards, single numbers and comprehensive personal social program data to be 
shared among governments, a national electronic health database, and several 
population registries; the permanent voters list, the firearms registry and the 


DNA databank. 


And there is also a hopeful note—the comprehensive and forceful report by the 
Parliamentary human rights committee on dealing with the impact of new 
technologies on privacy. 


The Customs - Employment Insurance Data Match 

Data matching links personal data from a variety of unrelated sources, virtually 
always in electronic form, to make administrative decisions about those using 
government programs and services. Since matching is an indirect—and usually 
invisible collection of data, the government has established a process to control 
the practice. 


One of the steps is providing the Privacy Commissioner with a "preliminary 
feasibility study" 60 days before the match is to begin. This allows the 
Commissioner, as an Officer of Parliament, to act as an advocate for the 
individuals whose records are to be matched. The Office reviews the proposal 


and makes any recommendations to the head of the department who 1s free to 
accept or ignore the comments. The Commissioner has no power to stop or 
alter the match. 


This lack of power has caused little difficulty until now; departments have been 
sensitive to the issue and generally accepted the Office's recommendations. But 
the times, they are a-changing. The advent of bottom-line management has 
prompted a get-tough attitude in departments which provide substantial benefit 
payments. All to the good, most taxpayers would say. Not so good, we say, 
when a match is so broad it risks more than offending the Privacy Act; it 
threatens fundamental rights. Such a case, we argue, is the match of travellers' 
Customs declarations with employment insurance benefit files. 


The practice at issue in this case is Human Resources Development Canada's 
(HRDC) match of data from Revenue Canada's Travellers Declaration Card, or 
Form E311, with records of Employment Insurance claimants to determine 
whether they had been out of the country while drawing benefits. 


The Customs declaration All travellers entering Canada by common carriers 
(air, train and bus) must complete the card and give it to the customs and 
immigration official at the entry point. Travellers supply their name, address, 
date of birth, the airline and flight number, whether arriving from the U.S. or 
elsewhere, the last three countries visited on the trip, whether the travel was 
business or personal, the type of goods they are bringing into Canada, whether 
they will visit a farm in the next 14 days, the date of departure from Canada, the 
date of return, the value of the goods they purchased and the personal exemption 
claimed. A customs stamp identifies the airport. 


Both departments approached the Office informally in June 1995 to discuss the 
proposed match. Given that the evidence of abuse was largely anecdotal, privacy 
staff asked the departments to provide some factual substantiation for the match, 
including a cost-benefit analysis. 


There are four phases to the match: a feasibility study to gather data for a cost 
benefit analysis, a reprocessing of the feasibility study, a proposed six-month pilot 
project and, finally, a projected full implementation in late 1997. 


The feasibility study In order to gather the data for a formal matching 
proposal, Revenue Canada and HRDC signed an agreement in June 1995 in 
which Revenue Canada would disclose traveller information to HRDC in order 
to conduct a feasibility study to detect potentially fraudulent EI claims. 


The agreement provided for the disclosure of traveller cards to begin July 4, 
1995. Revenue Canada would gather a sampling of traveller cards from nine 
airports for the months of June, September and November 1994 and February 
and March 1995. HRDC agreed not to take any enforcement measures against 
individuals identified through the matching process. 


Since Revenue Canada stores traveller declarations on microfiche, HRDC agreed 
to pay staff, working on site at Revenue Canada, to convert the information 
from the 16,861 samples into electronic format and load it onto diskettes. The 
data included name, date of birth, postal code, periods of travel and the 
microfiche roll and frame numbers on which the E311 is stored. 


The electronic match identified 257 individuals who were out of the country 
while receiving EI benefits, or 1.5 per cent of the sample. HRDC returned the 
diskettes to Revenue Canada and obtained a photocopy of the E311 cards of the 
257 individuals identified to validate the results of the match. 


The data matching proposal HRDC analyzed the results of the feasibility study 
and submitted a formal data matching proposal to the Office in January 1996. In 
a meeting to discuss the proposed pilot project, Privacy staff underlined the 
Office's concern about using retroactive data, the lack of notice to travellers 
about the unrelated use of Customs data during the pilot project, and the lack of 
a written agreement to cover the terms of the exchange. It was understood that 
all would be taken care of before the project was implemented. HRDC 
completed its data matching proposal at the end of February and the Office 
notified the department on March 19, 1996 that it would not object to its 
conducting the pilot project. . 


HRDC obtained again from Revenue Canada the data it had used during the 
feasibility study and simply reprocessed it to firm up the figures. In early July 
1996, HRDC gave copies of each matched individual's EI claim record and E311 
to the claimant's regional insurance representative. The regional office forwarded 
the information to the appropriate CEC which wrote to each claimant seeking an 
explanation for their travel while collecting EI benefits. Revenue Canada did not 
remove any of the irrelevant travel information from the E311 cards it gave 


HERD G. 


The pilot project HRDC considered its reprocessing of the feasibility study hits 
as the first phase of the pilot project. The departments did not sign a 
memorandum of understanding for the pilot project until April 1997. At the 
conclusion of the pilot, HRDC 1s to decide whether it will make the match an 
ongoing practice. HRDC continues to pay the costs of equipment and 


30 employees at Revenue Canada to create the electronic database. Revenue 
Canada now also discloses the purpose for the individual's travel. 


Since then, Revenue Canada has provided HRDC with computer tapes each 
month containing traveller declarations of Canadian residents during the months 
of December 1992, January to June 1993, December 1994 and January to March 
1995. Although the approved retention schedule for E-311 microfiche cards is 
two years, Revenue Canada has kept them since 1992 for no apparent customs 
purpose. Revenue Canada estimates that approximately 18 million visitors and 
returning residents enter Canada by air alone each year. 


The resulting hits and claim files are sent to the Miramichi Investigations Centre 
for verification and follow up. HRDC has taken action on the hits from 
December 1994 onwards. Individuals are contacted and those unable to justify 
their absence must repay the benefits for the period of absence, plus a penalty. 


The E311 cards used in the match included no public notice of the disclosure and’ 
use of customs information for detection of possible EI fraud. Nor has either 
HRDC or Revenue Canada "accounted publicly for the use and disclosure of 
personal information", as government matching policy requires. Revenue Canada 
has begun removing irrelevant travel details on the cards that are disclosed to 
HRDC in case where the claimant contests the recovery of EI benefits © 


The Commissioner concluded that the breadth of the match and its 
implementation were excessive. When repeated correspondence and meetings, 
including with both ministers, could not resolve the disagreement, he sought 
legal advice. 


The Commissioner is seeking the Federal Court's guidance on the question of 


whether searching every returning traveller on suspicion of defrauding EI offends 
the "unreasonable search and seizure" provisions (section 8) of the Charter. 
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One Stop Shopping—The Common Client 
iGemiabicr  y 


The past year has seen all levels of government examine new ways to improve 
their delivery of income security programs and to share their clients' personal 

information. The government believes, with some justification, that Canadians 
do not much care what level of government delivers the service as long as it is 
delivered. 


However, the most immediate impact of different governments and agencies 
sharing clients' personal information and program delivery is that the 
information will be linked and shared among many users inside and among 
governments. Individuals will have even less control over their personal 
information and greater accessibility will almost inevitably increase the chances 
that the information will be used or shared inappropriately—for purposes other 
than those for which it was collected. 


A second privacy concern is the need for a common method for all levels of 
government to identify or "authenticate" the client; thus a "common client 
identifier". Dependable personal identity is required at every step of the process, 
from applying for and delivery of financial benefits, linking to other programs 
and services, maintaining case files, controlling fraud and errors, and terminating 
benefits, Thus a common client identifier is considered critical. So too is a 
central database accessible to all income security programs and levéls of 
government. 


In effect, the proposals amount to comprehensive and systematic data matching 
on a scale never done before. 


A group of information technology managers from the income security 
departments of the federal, provincial and territorial governments have been 
studying the issues. The group's recently-released report, Enhanced Service 
Delivery Through a Common Client Identifier: Options and Opportunities, suggests 
that using a common identifier (and its supporting database) could produce 
significant gains. It would properly identify legitimate claimants before the 
benefits are paid, rather than matching data after the fact to detect fraud, then 
attempting to recover improper payments. 


The report identifies several important features of an effective common identifier. 


These include the need for it to be used in all jurisdictions, unique to the 
individual, applicable to all benefit programs, and secure against forgery or 
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tampering. The common client identifier must also protect privacy and result in 
minimal intrusion into clients' lives. Among the options the group considered 
for a common client identifier were: 


® the status quo (name/birth date) 
e the current Social Insurance Number (SIN) 


ea "modernized" SIN (including positive client identification, such as a PIN) 
and establishing the SIN Register as a central database which would identify 
every individual in all income security programs) 


¢ a "new" number to act as a common identifer for all federal/provincial/ 
territorial income security programs 


e the provincial health care number. 


The working group seems to favour either a modernized SIN (with the existing 
SIN acting as a transitional Common Client Identifier) or a new number created 
specifically as the common identifier. The notion of using provincial health 
cards and any "biometric" features (such as digitized fingerprints) seems to have 
been rejected for now. 


Although we are prepared to keep an open mind on many aspects of the group's 
work, any proposal that builds on the existing SIN is in for heavy weather. 
Never was a personal identifier so compromised. While the federal government 
has a restrictive policy on its own uses (since 1989) SINs are everywhere— 
landlords, credit bureaus, libraries, video stores, supermarkets—the shorter list is 
who does not have them. Constructing a common client identifier on the SIN 1s 
building on sand. | 


The working group acknowledges that among the barriers to success are public 
concerns about individual privacy and confidentiality, restrictions against sharing 
and disclosure in both privacy and program legislation and legislative restrictions 
on the use of the SIN. In fact the report identifies the perceived impact on 
privacy as the single greatest barrier to the development of a common identifier. 


In this respect, the report is right. While more efficient delivery of government 
services is a noble goal, in its pursuit we may well demolish the walls so carefully 
constructed around personal data files. These walls prevent governments from 
assembling comprehensive personal profiles of their citizens and from using 
information collected for one purpose for a totally unrelated purpose. 

Protecting privacy in this context requires, to paraphrase an American Supreme 
Court decision, "[protecting] the fragile values of a vulnerable citizenry from the 
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overbearing concern for efficiency that may characterize praise-worthy 
government officials no less, and perhaps more, than mediocre ones." 


Government must address several matters before accepting the concept of a 
common client identifier: First, there must be sound, proven justifications for 
pursuing such an identifier. To date, there has been a noticeable lack of 
empirical evidence supporting its introduction. There is no lack of desire to find 
a quick fix by applying technology to social and economic problems, but the 
search for such solutions must not replace a hard-nosed analysis of their merits . 


Second, if governments can demonstrate the need, then legislation must precede 
any development of a common client identifier. As Alberta Privacy 
Commissioner Robert Clark remarked, we cannot have the "technocrats stepping 
on the democrats". The uses of the identifier and privacy protection mechanisms 
must be specifically set out in legislation, and there must be stringent penalties 
for misuse of the system. 


Finally, the impact of introducing a common client identifier must be fully 
understood before any implementation. Both a privacy impact assessment and a 
broader societal impact assessment should be completed. While the report has no 
official endorsement, it will likely form the basis for Human Resources 
Development Canada to develop a business case for a common identifier in 
income security programs. 


The Privacy Commissioner has agreed to comment on the substantial privacy 
impact of the project with the usual caveat; he cannot give seals of approval. 
The Commissioner must guard his independence in order to be a credible and 
unbiased investigator of any complaints. 


The federal Privacy Commissioner is not the only one concerned about this 
issue. Provincial and territorial commissioners too are watching warily. The 
Office has agreed to gather and share information and co-ordinate the response of 
privacy commissioners. 
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A National Health Database 


The National Forum on Health, a panel of health experts, was established by the 
Prime Minister in 1994 to “involve and inform" Canadians about health care 
issues. The Forum was also to advise the federal government on ways to 
improve Canadians’ health and the health care system. Among the Forum's 
recommendations in its 1997 final report, Canada Health Action: Building on the 
Legacy, are several on the need for better information or "appropriate, balanced 
and high-quality evidence" to improve health care decisions. In the terminology 
of the profession, this is "evidence-based" medicine. 


Specifically, the Forum recommends exploring the role information technology 
could play in setting up a national health data network. The 1997 federal budget 
set aside $50 million for a Canadian Health Information System to include a 
national health surveillance network, a population health clearinghouse and a 
First Nations health information system. 


The Forum also proposes that provincial and territorial agencies develop and 
maintain a standardized set of longitudinal data to chart changes in individuals’ 
health status over time. 


And, finally, the Forum suggests that collecting and integrating all ‘Canadians' 
health data is not enough; a person's health is influenced by a number of factors, 
many of them non-medical. Thus, the forum is interested in studying the 
relationship between health and social status, and how social and economic 
factors such as poverty, unemployment and cuts in social support affect 
individual's health. The Forum advocates linking clinical and administrative 
health data with such non-medical information as income, employment and 
educational status. However, it wishes to exempt health research from the 
normal obligations of privacy laws—such as obtaining the patients’ consent for 
use of their personal information, destruction of the data on approved schedules, 
and obtaining the patient's authorization for further disclosures. 


In summary, the Forum's recommendations foster an accelerated government 
drive for access to patient information in the hope of better controlling and 
managing the delivery of health care services. The recommendations also 
advance the notion that the research community should have access to the 
records of the entire Canadian population, yet should be exempt from privacy 
laws governing access to, and use of, that data. And, finally, in the interests of 
efficient care and research, it further proposes to computerize all these files to 
improve the flow of information across all jurisdictions. 
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While we cannot assess the claimed superiority of evidence-based medicine, we 
can say that adopting an evidence-based system is potentially one of the most 
significant privacy issues of the decade for Canadians. It represents a revolution 
in the way health information is collected, disseminated and used because it relies 
on state-of-the-art information technology to integrate information from all 
health sectors—for example, doctors, hospitals and pharmacists. It also envisages 
amalgamating health information with socio-economic data such as education and 
income. And it recommends that not just health care providers, but all health 
administrators and policy makers, have access to the information to make 
decisions about health care. Information about specific individuals, not aggregate 
data, is one of the key requirements for developing such a system. 


It is hard to argue with any proposal to make better-informed health care 
decisions. Privacy advocates want effective health care as much the next 
Canadian. We also recognize that broader research may enhance our 
understanding of the factors affecting our health and improve delivery of health 
services. 


However, using personal health information to foster an improved health care 
system is not a purely a win-win scenario. The Forum's proposals pose 
significant challenges to the privacy of Canadians’ medical records—the right to 
protect the confidentiality of that personal information, and the right to be 
informed of, and consent to, all other uses of that information. The prospect of — 
greatly expanded collection and sharing of personal medical information sets 
privacy alarms ringing. 


Traditionally privacy laws and medical ethics have allowed only those directly 
involved in patient care to have access to patient medical records. Medical ethics 
and legal prohibitions exact a high standard of care and protection for the 
confidentiality of medical records. With few exceptions, the right to control the 
flow of one's personal medical information rests with the patient, not the 
physician, nor the hospital, nor the state. 


An information network to support evidence-based health care would turn that 
important centuries-old rule on its head. Medical records, currently accessible to 
patients and a limited number of others, could no longer be said to be 
confidential when hundreds of strangers can access them electronically. 


The experience south of our border merits mention. American law professors 
Paul Schwartz and Joel Reidenberg cite an observation in a U.S. medical journal 
that "medicine is increasingly a spectator sport." Say Schwartz and Reidenberg, 
"A widening audience of outside observers now watch the performance of 
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doctors, nurses and patients, and personal data plays a critical role in the 
evaluation of their behaviour." 


Canadians may argue that our health care system is different—that the strong 
government component in our health care system makes the information in the 
system less vulnerable to abuse. We argue that it is precisely because the state 
has such an important role in delivering health care that there must be 
mechanisms for the individual to counter that power and exert some control. 
While Canadians tend to view government as largely benign, that should not 
mean abdicating individual consent and responsibility. 


As well, our system is becoming increasingly privatized; services such as home 
care, speech pathology and various types of testing are now performed by private 
companies. And now with the advent of drug plans, pharmacies (which have 
always been private) deal frequently with private insurance companies and do so 
increasingly on-line. We will see the same pressures that now exist in the U.S. to 
use medical information for purposes that have nothing to do with the health of ° 
the patient or even the good of society. Personal health information will become 
an ever more valuable commodity in the data marketplace. 


Canada must not seize upon evidence-based health as a medical nirvana without 
sober reflection on the impact this massive assembly of personal 
information—health and other—may have on our privacy and autonomy. 


Some Canadians may not object to substantially diminishing the confidentiality 
of their medical records. But the freedom to decide whether to participate in 
such a wide-ranging scheme is an essential component of privacy protection and 
democracy, and must be preserved. To protect those who object, any health 
network must allow individuals to prevent their medical information from being 
stored and accessible on this network. And people who choose not to participate 
should not be penalized by receiving a lesser standard of health care. 


It is essential to get a grip on the issues involved in preserving the privacy of 
health care information. Among the measures we propose are the following: 


e Enact complementary federal and provincial legislation to protect the privacy 
of the full range of personally identifiable health care information. The 
legislation would incorporate the fair information principles of international 
data protection agreements. This must be done before the health network 
develops further. 


e Establish clear requirements for obtaining the informed consent of patients to 
disclosures of personal information. In the absence of informed consent, an 
individual's right to control the disclosure of personal medical information 
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should be paramount. That right should be overruled only in the face of an 
overwhelming and compelling public interest (or to provide the patient 
emergency care). Conducting research does not always constitute an 
overwhelming or compelling public interest. 


e Establish strict limits and controls on the circumstances under which access 
to personally-identifiable information 1s granted to secondary users for 
research purposes and encourage the conduct of research through the use of 
aggregate, de-personalized data. 


e Establish strong remedies in law for disclosing information without a 
patient's consent. 


e Educate patients about how their records are used and the privacy 
implications of having their medical records computerized and placed on a 
national network. 


e Develop guidelines to address the privacy and security issues raised by the 
computerization of patient data, including provisions for full audit and 
control. 


e Establish an independent review mechanism to oversee the privacy of health 
care information. 


If medical records are linked to employment, educational and other 
socioeconomic databases, they would reveal not just medical information but 
whole life histories. For the medical community, this may be the point. But, 
easy as it is to rationalize data gathering as beneficial for the individual and 
society, the information might not be used for benevolent purposes. The 
collection of medical data can slide imperceptibly from health care to medical 
supervision to lifestyle surveillance and, ultimately, to a more generalized form of 
surveillance by the state. 


For this reason, it is critically important that we examine how to prevent further 
secondary uses of this information, such as by law enforcement agencies, 
employers and private individuals (such widespread uses are almost the norm in 
the United States). The purpose of those databases must be limited to advancing 
health care, and nothing else. They must not be allowed to become a convenient 
means for government agencies and private businesses to conduct non-medical 
surveillance of citizens who are simply making use of an essential service. 


Of course, there is a balance of interests to be weighed between the two poles of 
better personal and societal health, and individual autonomy. And we 
acknowledge the potential peneteiel uses of health information and the 
importance of research. There are important differences between using personal 
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data and aggregate data, stripped of personal identifiers. But we insist that 
protecting the privacy and confidentiality of individual health information is also 
critical to open communication between medical personnel and patient, and 
patients’ trust in the system. Protecting privacy deserves as high a priority as 
improving health systems. 


The Final Report of the National Forum on Health recognizes the importance of 
privacy in developing a national health information system. And the federal 
health department intends to address privacy in its planning of such a system and 
we hope to assist this critical work. But a Canadian health information system 
could either stand or fall on the extent to which it incorporates privacy, patient 
autonomy and informed consent. How well privacy fares in the development of 
this system may well determine whether the public will be willing 
participants—or will mount the barricades to protest against the extraordinary 
level of surveillance it makes possible. 


We look forward to legislative guarantees that the system will protect rather than’ 
jeopardize individual health information. 


Correction: Last year's annual report expressed concern about the lack of legal 
protection for data in a national longitudinal health survey being conducted by 
the Canadian Institute for Health Information. In fact, the survey is being 
conducted by Statistics Canada under the authority (and protection) of the 
Statistics Act. We apologize for the error. 
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Population Registers 


The perennial challenge of population registers for a privacy ombudsman is 
where to draw the line between pragmatic acceptance of lists assembled for 
administrative purposes (but with solid privacy protection) and a healthy sense of 
unease at the growing pressures to identify and quantify citizens in various 
electronic databases. Once in a database it is but a small step to comprehensive 
profiles, all in the name of greater efficiency. 


The Office followed the creation of several registers this year with varying 
degrees of concern; the permanent voters register, the firearms registry and the 


proposed DNA data bank. 
The Permanent Voters Register 


On April 10, 1997, federal enumerators began going door-to-door for the last 
time. Information collected from this final, in-person enumeration will form a 
permanent electronic register of electors. The register is the culmination of 
several years of work for Elections Canada. From now on, lists for federal 
elections—and, potentially, for provincial and municipal elections—will be drawn 
from the register which will be updated from other federal databases (with the 
voter's consent) and, eventually, from specified provincial data bases. 


Although the idea of a permanent electronic voters register had been floated 
before, work began seriously at Elections Canada in 1994. Knowing the 
Commissioner's concern about building such a comprehensive electronic register 
of citizens, Elections Canada approached him to provide systematic input to the 
project as it progressed. The Commissioner agreed and assigned a staff member 
to contribute. The Office's emphasis during the exercise was on what 
information Canadians need to surrender in order to exercise their right to vote, 
and how best to protect that information in an electronic data base. 


In October 1996, amendments to the Elections Act were tabled in the House of 
Commons and the Commissioner was asked to appear to comment on the 
privacy implications. The amendments responded to most of his 
recommendations appearing in the 1995-96 annual report (A Vote for Privacy? 


page 14). 


Other uses of the register The greatest worry with this type of register is that 
government will be tempted to use it for unrelated purposes. With growing 
budget pressures, and the electronic means at their disposal, bureaucrats 
increasingly view any personal data as fair game for any purpose—the "why 
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should you care if you have nothing to hide?" school of administration. The 
Commissioner sought legislative guarantees that the register would not be 
available for uses other than to permit Canadians to vote. The law now forbids 
any uses of the register other than for electoral purposes. 


Updating by datamatching A second important reservation was the proposal to 
update the list by collecting voters’ personal data electronically from other federal 
data bases such as income tax returns. This type of data match is invisible and 
violates a fundamental principle of privacy protection—informed consent. 


The Commissioner recommended, and Elections Canada agreed, to match data 
only with the voter's active consent. A box will appear on next year's income 
tax return offering voters the option of having Revenue Canada transfer only 
current names, addresses and dates of birth to Elections Canada. Revenue 
Canada will not disclose any other details. New citizens can also ask Citizenship 
& Immigration Canada to send their information automatically to Elections 
Canada for inclusion in the voters register. Matches with provincial data bases, 
such as drivers’ licences or provincial and municipal voters’ lists, will have to 
comply with any provincial privacy laws. 


Annual disclosure of lists to political parties Until this latest round of 
amendments, political parties and candidates received copies of the lists only 
when writs were issued for an election. These amendments allow for annual 
disclosures of lists to all parties running a candidate in a riding and to the current 
member, presumably because they will now be updated more or less constantly. 
The Commissioner considers annual disclosures excessive, not needed for the 
electoral process and potentially an inducement to more frequent canvassing. 
Nevertheless, Parliament approved annual disclosures. 


No telephone numbers The Commissioner also recommended against collecting 
telephone numbers and including these on the lists provided to political parties 
and candidates, arguing that furnishing this information would make the electoral 
process the agent for telephone canvassing. Of course, political parties can buy 
software to blend the election lists with electronic telephone directories but they 
can do so at their own cost. Elections Canada dropped the telephone number 
from the data to be collected for federal elections (some provinces require the 
number for provincial elections). 


Power to collect more data defined The provision allowing the Chief Electoral 
Officer to collect other personal data, once open-ended, is now more narrowly 
defined as that needed to "implement agreements with provincial bodies". The 
effect is to allow Elections Canada to collect additional details (such as 
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occupation) if they are required to vote in a province. Any additional 
information will not appear on lists compiled for federal elections. 

The right to opt out The right not to be in the register was certainly the most 
fundamental privacy question and one which met no opposition from Elections 
Canada. Not being in the register will not deprive anyone of their right to vote 
but it will mean taking an active step to put one's name on the voters list, once 
an election is called. 


Unfortunately, despite the best intentions, this aspect of the new process may 
have broken down. Based on admittedly anecdotal evidence from staff and 
callers at this and other commissioners' offices, enumerators seemed not to have 
understood the optional nature of the register. In fact, some told Canadians that 
if they were not in the register, they could not vote. However, enumerators 
cannot be faulted for misleading voters; they may not have been told. Privacy 
staff confirmed that the training materials did not mention the option; apparently 
the matter was to be dealt with verbally during the two-hour training sessions. 
Admittedly, training 96,000 enumerators across the country is a communications 
challenge, and teething troubles are hardly unexpected in an undertaking of this 
magnitude. Given the interest and the commitment of the Chief Electoral 
Officer and his staff to reinforce privacy in the electronic register, we hope and 
expect that the glitches will be remedied. 


Anyone who was not properly informed and does not wish to be in the register 
can remove his/her name by writing to the Chief Electoral Officer at 257 Slater 
Street, Ottawa, K1A OM6. 


The Firearms Registry 


The privacy issues surrounding the proposed legislation on gun control were 
evident in 1994 when it became clear that the government was contemplating a 
registry. Privacy staff met registry officials to discuss what information would be 
collected, by whom, where held, under whose control—and thus subject to what 
privacy law, if any. Managing the information was important because the model 
being contemplated bore some resemblance to the Canadian Police Information 
Centre (CPIC) which is a national police cooperative, administered by the 
RCMP, but not a federal undertaking and therefore only partly subject to federal 
privacy law. Its status had raised thorny jurisdictional issues for more than one 
privacy commissioner. (CPIC now has a national privacy policy to which all 
members must adhere.) 


The Firearms Act (Bill C-68) passed Parliament in June 1995 with no specific 
privacy language in place and, given its hybrid nature, without the registry being 
made subject to the federal Privacy Act. The Commissioner was assured that 
privacy obligations would be spelled out in the regulations to follow and was 
encouraged to give his input then. The Senate Committee on Legal and 
Constitutional Affairs did not wait. Recognizing the privacy issues at stake, they 
called the Commissioner to appear. 


In short, the Commissioner observed that the bill anticipated collection of 
substantial and potentially sensitive personal information which needed 
protection in the law or, failing that, in the regulations. Firearms registrars will 
maintain records of every licence and certificate issued and revoked, application 
refused, every loss, finding, theft or destruction of a firearm, as well as both 
exports and imports. In addition, local firearms officers, who may be provincial 
or municipal officials, will gather highly personal medical and domestic details on 
firearms applications. The Commissioner commended the Privacy Act's fair 
information code as a model for appropriate collection, use and disclosure of any 
personal data needed for the register and recommended making those PONG Gs 
clear in the law. 


In April 1996, regulations were submitted, then withdrawn and a new set 
submitted in November 1996. They provided very little detail. Nevertheless, the 
accompanying regulatory impact analysis stated firmly that "matters of access to 
the information kept, and the privacy of that information will be found in the 
relevant provincial and federal law" and that the "law is comprehensive and deals 
adequately with all the issues...". 


The Commissioner begged to disagree. In a February 1997 appearance before the 
House of Commons Subcommittee examining the regulations, he pointed out 
first, that not all jurisdictions have privacy law. Second, some provincial privacy 
laws deal only with access to personal records and establish no rules on 
appropriate collection, use and disclosure of personal information. Third, some 
provincial laws do not cover the municipal police forces who often will gather 
and control the records. In short, there are gaping holes in the legal protection. 


Since the regulations themselves provide little detail, it now appears that only the 
forms and schematic of the process will provide the answers—far too late to 
provide legal protection. Nevertheless, two regulations warrant particular 
mention. The first concerns procedures to obtain a licence which include the 
police notifying current and former spouses, and broad powers and discretion to 
gather "additional" information about applicants. 
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While the intent of the provisions are clearly to protect public and individual 
safety, the process needs some accountability to ensure the information is 
credible and relevant. Anyone providing information which is used to determine 
the applicant's suitability for a licence should be prepared to have their 
comments given to the applicant. Being able to face one's accusers is a 
fundamental principle of both privacy law and natural justice. Any deviations 
should be exceptional, not the rule. Having a comprehensive privacy scheme in 
place would enhance the accuracy and currency of the information by allowing 
applicants to correct factual errors and annotate disputed information. And some 
attempt should be made to define what types of "additional" information may be 
relevant to granting a licence so as to prevent "fishing expeditions". 


The second omission is an interim review process for those denied a licence. The 
current scheme requires the unsuccessful applicant to go directly to court. Apart 
from the burden this places on both the applicant and, one would argue, the 
courts, it also risks disclosures of potentially sensitive personal details in an open 
process, some or all of which may be disputed. It seems a heavy-handed 
approach to challenging an administrative decision where an independent third 
party or panel would serve as well at lower cost. 


The Subcommittee passed the regulations but made two recommendations to deal 
with the privacy issues. The first recommended that the government negotiate a 
memorandum of understanding with each province and territory, establishing 
that the Firearms Act is a federal statute, subject to the Privacy Act where no 
comparable provincial privacy law exists, and setting out rules of application in 
those jurisdictions. The government accepted the recommendation. 


However, the government rejected the second recommendation for a mediation 
mechanism to allow applicants "to challenge allegedly false or inaccurate 
information without resort to court action". It argued that investigative 
techniques already ensure that the decisions are not based on inaccurate 
information and the investigations will normally give an applicant an 
opportunity to be heard. While it undertook to see whether the investigative 
process could be improved to deal with privacy concerns, the Department of 
Justice rejected mediation as "incompatible with the overriding safety objectives 
of the legislation". 


The Commissioner is unconvinced. 
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DNA Databanking 


On April 10, 1997, the government introduced Bill C-94, the DNA Identification 
Act, in Parliament. The purpose of the bill was to establish a DNA databank of 
samples taken from convicted offenders to help police identify those responsible 
for other unsolved crimes. The bill was the second phase of the government’s 
scheme to regulate DNA testing as a tool to identify individuals responsible for 
certain crimes. Although it died on the order paper with the election call, 
several aspects of the Bill give cause for concern. There is now an opportunity 
to get it right. 


But first, to backtrack. The first phase of the government's DNA testing plan 
was passed in 1995, allowing police to take samples without consent from 
individuals suspected of criminal offenses, generally those involving serious 
violence. The sample taken from the suspect would be matched with samples 
from the crime scene to determine whether the suspect had committed the 
specific offence being investigated. The legislation did not deal with the storage ’ 
of the information—or samples—derived from the testing. This was one of a 
number of issues left for the second phase. 


We cautiously supported the 1995 legislation. DNA evidence can help convict 
the guilty and absolve the innocent, and the 1995 legislation provided a — 
reasonable scheme to ensure that DNA samples were not taken from suspects 
unnecessarily. Then, early in 1996, the Solicitor General issued a discussion 
paper (Establishing a National DNA Databank) which examined several other 


issues, including the storage questions, and:asked for comment. 


Our response to the discussion paper made several suggestions for the 
government to consider before introducing legislation. Among them were three 
major conditions that needed to be met to satisfy privacy concerns: 


e reviewing the legislation within three to five years of its enactment, including 
a privacy audit to determine to what extent the intrusion involved in creating 
a database was justified by an increased number of violent crimes solved 
through DNA evidence; 


e taking DNA samples only from those convicted of a violent offence for 
which there is a high risk of re-offending and a high likelihood that genetic 


material would be left at the crime scene, and 


e destroying the DNA samples after extracting the identification information, 
leaving only the analysis on police files. 
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Bill C-94 did propose a general review of the legislation within five years of its 
enactment. However, its treatment of the other issues is problematic. 


The "designated offenses" First, the range of offenses for which samples could 
be taken from convicted offenders appears unnecessarily broad. It may seem 
trivial to quibble over the criminal offenses for which the state could compel 
offenders to provide a DNA sample. It is not. This technology empowers the 
state to intrude into our very bodies—a power it should exercise only in the most 
compelling circumstances. Casting the net too wide results in privacy intrusions 
on a massive scale. 


The Bill contained a list of "primary designated offenses"; generally serious, and 
frequently violent, crimes such as manslaughter, sexual assault and kidnapping. 
Taking a DNA sample is automatic on conviction for these offenses. However, a 
list of "secondary designated offenses" for which police may seek a warrant for a 
DNA sample includes (among others) common assault, breaking and entering, 
setting fire to "other substances" and failing to stop at the scene of an accident. 


Storing the DNA samples Among our most serious reservations about 

Bill C-94 is the plan to store the DNA samples themselves, rather than just the 
analysis—the information drawn from the samples. This is not too fine a 
distinction to make. This legislation seeks to use DNA to link specific offenders 
with specific crimes. Keeping the DNA sample itself will inevitably invite 
further uses of the DNA that have little to do with identifying offenders; for 
example, allowing researchers to use the material to study genetic links to 
criminal behaviour. This century has already seen one misapplication of genetic 
research to criminal behaviour (the XYY chromosome theory which purported 
to identify violent males). 


We remain strongly opposed to retaining DNA samples. Analysis of the DNA is 
sufficient to help police solve crimes, without the need to preserve the actual 
sample. 


The policy makers behind Bill C-94 had a choice. They could choose the least 
intrusive measure; retaining the information they needed for forensic DNA 
identification, or the most intrusive measure; keeping the DNA samples 
themselves. They chose the latter. 


The seriousness of the privacy invasion—allowing the state access to our 
bodies—warrants the least intrusive means. That means storing identifying 
information only. Should keeping only the analysis prove an unworkable 
limitation on investigations, the subsequent review would allow Parliament to 
address the issue. By adopting the most intrusive measure first, we will have no 


way of knowing whether the lesser intrusion would have been sufficient. And 
few of us would expect the state to surrender a power once it is acquired. 


We also continue to be concerned about authorizing police officers to take DNA 
samples. There is something chilling about a police officer, not medical 
personnel, performing what is essentially a forced medical procedure, no matter 
how minor or painless. 


Destroying "volunteered" samples The bill is silent on another source of 
concern—the treatment of DNA samples from "volunteers". A recent sexual 
assault case in Vermilion, Alberta illustrates the problem. Police asked male 
residents to volunteer DNA samples to help eliminate them as suspects in an 
investigation (in other words, to prove their innocence, an odd twist to one of 
the fundamental presumptions of our criminal justice system). | 


Having given the police a DNA sample for that investigation, the volunteer 
should have a right to have that sample and any analysis destroyed immediately 
after it has proven that they were not implicated. DNA samples taken from 
volunteers should never be retained, and the analysis of those samples should 
never be kept for a database. Nor should they be used to investigate any crimes 
other than the one for which they were gathered, unless the person gives a fully- 
informed consent to further uses. | 


Unfortunately, Bill C-94 offered no provision to ensure that volunteered samples 
and any information relating to them would be destroyed as soon as they proved 
the donor's innocence. 


Reopening the DNA issue on another front 
On April 14, 1997, shortly after Bill C-94 was introduced, the Canadian Police 
Association (CPA) placed full-page advertisements in The Hill Times calling for 


extending the current law on identification of criminals to DNA technology: 


[T]he current law, pursuant to the /dentification of Criminals Act, which 
permits the taking of offender information (fingerprints) at time of arrest 
for indictable offenses, [is] exactly the process which must be followed 
with the technological upgrade which DNA samples represent. 


The Association appears to advocate taking DNA samples, like fingerprints, as a 
matter of course from anyone arrested for an indictable offence. It is clear that 
the Association wants to use the DNA databank bill to obtain expanded powers 
to take DNA samples from suspects—the issue that was the focus of the DNA 
legislation passed by Parliament in June 1995. 
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CPA's attempt to expand the taking of DNA samples from suspects is extremely 
troubling. DNA samples cannot be equated with fingerprints. True, both offer 
information that can identify an individual. Fingerprints do no more. However, 
human DNA contains a storehouse of highly personal information that has 
nothing to do with linking a person with a crime, and that can be seriously 
damaging to an individual if allowed to fall into the wrong hands. 


The office has spent considerable energy ensuring that DNA samples could be 
collected from suspects where warranted, while respecting the legitimate privacy 
rights of Canadians. Apparently the points we made in our first (1995) 
submission on the issue of forensic DNA analysis bear repeating: 


DNA evidence should not be collected from suspects as a matter of routine. 
To do so causes an unnecessary privacy intrusion; in the vast majority of 
criminal cases DNA evidence will contribute nothing to the investigation. 
Thus, it would not be appropriate for Parliament to give blanket authority 
to collect DNA samples from all persons suspected of indictable offenses. 
DNA should also not be collected from a suspect if investigators have no 
DNA evidence with which to compare the suspect's sample. 


Nor would a DNA sample from the suspect be necessary if the suspect 
admitted guilt. However, as a practical matter, the DNA evidence might 
be critically important in getting the suspect to admit guilt in the first 
place. 


In short, we recommend the following conditions on the collection of 
DNA samples from suspects: 


(a) the crime must involve violence or the likelihood of violence 


(b) there must be reasonable grounds for suspecting that the person 
committed the offence 


(c) a DNA sample must be relevant to proving the offence; investigators 
must have DNA related to the crime with which the suspect's sample 
can be compared, and 


(d) the collection from the suspect must be authorized by a judge. 
Our position was largely reflected in the DNA legislation passed in 1995. Now, 
however, the CPA wants to remove three of these four privacy safeguards: the 


requirement of a violent crime, the relevance of the DNA sample to proving the 
offence, and the requirement of a judicial warrant. 
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The CPA's proposal would also lift the restriction, accepted in the 1995 law, that 
a sample taken under warrant be used only to investigate the offence in question. 


The thirst for ever greater police "efficiency" by using intrusive 
technologies—technologies that may not live up to their promise—must not be 
allowed to override this fundamental right of privacy without a clear and 
compelling justification. The CPA has offered no such justification. 


Position papers on both issues, compulsory collection of DNA samples from 


suspects in a specific crime and establishment of a DNA database, are available 
from our office and at our Internet web site: http://infoweb.magi.com/ ~ privcan/. 
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Where Should Parliament Draw the Line? 


In April 1997, shortly before Parliament was dissolved for the federal election, 
the House of Commons Standing Committee on Human Rights and the Status of 
Persons with Disabilitiés issued its report, Privacy: Where do we Draw the Line? 
The committee, chaired by the Hon. Sheila Finestone, examined a range of 
privacy issues flowing from new technologies. The report is a must-read for 
anyone interested in preserving some vestige of their privacy. 


Mrs. Finestone referred to the stunning impact of reports from the Privacy 
Commissioner of Canada and subsequently from specialists, on the wide-ranging 
capabilities of new technologies and their implications upon the right to privacy. 


To the committee’s great credit, it did not merely listen politely to those 
concerns, then walk away—as some Parliamentary committees have done. 
Instead, the human rights committee concluded that it was time to "explore the 
role of privacy as a human right and social value". The committee soon realized 
the importance of its mission: "As we struggled with the impact of new 
technologies on our understanding of privacy, we realized that, ultimately, we 
were talking about what kind of society we want for our future". 


To make its task even remotely manageable, the committee focused its 
examination on the privacy impact of three technologies on peoples’ 
lives—advanced video surveillance, genetic testing and smart cards. These, the 
committee report argued, were examples of technologies on the cutting-edge 
where real choices will soon have to be made. 


The committee’s work had two phases. First, members heard from a range of 
international privacy experts (many of them, we are proud to say, Canadian). 
Second, it conducted a series of "town hall" meetings across Canada to learn how 
Canadians felt about their privacy and the government’s role in protecting that 
right. 


The committee’s task was truly daunting. Our office is often overwhelmed by 
the growing number of instances where technologies threaten the fundamental 
human right of privacy. For a Parliamentary committee, whose members all had 
multiple other responsibilities, addressing even a handful of these important 
issues would not be easy. 


Despite the magnitude of its task, what emerged from the committee’s ten 
months of consultations and research was an intelligent and thoughtful program 
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for government to begin addressing the prey threats Canadians face at the end 
of this century. 


Most important, the committee reinforced the importance of privacy as a 
fundamental human right. The committee’s proposed Canadian Charter of 
Privacy Rights, a kind of "quasi-constitutional" document that would take 
precedence over other federal legislation, would guarantee the expectation and 
enjoyment of 


e physical, bodily and psychological integrity and privacy; 
® privacy of personal information; 

e freedom from surveillance; 

e privacy of personal communications, and 


e privacy of personal space. 


These rights could be infringed only if the interference were reasonable and could 
be demonstrably justified in a free and democratic society. In other words, 
privacy should be the natural state of affairs; a right of Canadians that should not 
require justification. Instead, the onus would rest with government (or the 
federally regulated private sector, such as banks, to which the Charter would also 
apply) to justify privacy intrusions. 


The report also calls on the government to introduce legislation to "deal 
specifically with the privacy and antidiscrimination issues related to genetic 
testing", as well as amendments to the Criminal Code to extend current: 
prohibitions against interception of private communications to surreptitious 
video surveillance. 


Some of the committee's recommendations would have significant impact on the 
Office of the Privacy Commissioner. 


The first calls for replacing the current Privacy Act with a Data Protection Act 
which would extend privacy protection to personal information held by 
Parliament, all federal government departments, agencies, Crown corporations, 
boards and commissions, and the federally-regulated private sector. (The current 
act applies only to approximately 105 federal bodies named in the 
schedule—government departments for the most part.) An important part of the 
new law would be stricter rules on data matching within the federal government 
and data sharing between the federal and provincial and territorial governments. 
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The committee also recommends new legislation to broaden and strengthen the 
mandate and powers of the Privacy Commissioner to deal with privacy issues in 
the federal sector. In addition to the Commissioner's current obligations to both 
receive and initiate privacy complaints, the committee recommended empowering 
the Commissioner to conduct audits, technology impact assessments and studies 
on privacy and emerging technologies. It also advocated that the Commissioner 
review legislation, regulations, policies and practices that may have an impact on 
privacy rights and, when appropriate, table a privacy impact statement before the 
House of Commons. 


The legislation would be preceded by a broad and open public consultation 
process and also provide for a comprehensive public review of its provisions and 
operations within five years (and at regular intervals thereafter). 


Among the committee’s many other recommendations: 


e an explicit constitutional right to privacy in the long term; 


e framework data protection legislation governing the federally-regulated 
private sector; 


e efforts to build generally uniform privacy laws across the country; 


e access to and use of privacy enhancing technologies, and support for the 
creation and availability of such technologies; 


e greater public education about privacy issues, and a formal education 
mandate for the Office of the Privacy Commissioner of Canada; 


The committee’s report is a voice of salvation for the too-often besieged right to 
privacy of Canadians. The report calls for much of what this Office has long 
advocated, and proposes much else that we can comfortably support. The 
challenge now is to translate the committee’s concerns into action. A new 
government may have new priorities—we will do our utmost to ensure that 
acting on the committee's report becomes one of them. 
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Privatization and Devolution: Who's in, who's 
out? 


The discussion in last year's annual report about the privacy implications of 
government privatization met with some puzzled responses. Why was privacy a 
concern? The case most immediately at issue was Transport Canada's transfer of 
the air traffic control system to NAV CANADA, a not-for-profit corporation. 


However, NAV CANADA was simply the first of a number of federal agencies 
undergoing metamorphoses; some simply into new government agencies, some 
into private but not-for-profit organizations, and others into private companies. 
The common thread was that no provisions were being made to continue the 
privacy rights acquired by clients and employees of the organizations. 


Early in 1995, the Privacy Commissioner alerted government and the public to 
the oa unanticipated consequence of contracting out services and handing 
off federal operations to the private sector. In his report to the Standing 
Committee on Government Operations, the Commissioner recommended that 
the government | 


e issue a broad policy directive that all personal information handled by the 
private sector for, or in lieu of, government remain the property of the 
Crown and subject to its control for purposes of the Privacy Act; 


e require all government institutions subject to the Act to insert comprehensive 
data protection provisions in contracts with the private sector; 


e prohibit federal institutions from reducing the scope of privacy rights as a 
consequence of dealing with the private sector, and 


e in the interim, extend the Privacy Act to cover all federal institutions and all 
federally-regulated private sector enterprises. 


Soon after the creation of NAV CANADA, the government offered for outright 
sale the printing operation of the Canada Communication Group (CCG), 
formerly the Queen's Printer. The Privacy Commissioner wrote to the deputy 
heads of both Transport Canada and Public Works and Government Services 
(PWGS) asking that they commit to maintaining pevasy protection. Neither 
deputy agreed. 


In his mid-1996 appearance before the Commons Transport Committee, the 
Commissioner recommended making NAV CANADA subject to the Privacy Act 
to ensure continuing privacy protection. He also alerted members to the perils 
of privatizing a substantial government operation without the benefit of a cogent 
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information management plan. The Committee agreed and recommended the 
government include the provision in the enabling legislation. NAV CANADA 
resisted, the government ignored the recommendation and the legislation passed 
unchanged. 


Staff also approached CCG to offer input on reviewing the personal records it 
anticipated transferring to St. Joseph Corporation, the new owners. CCG 
accepted and over the ensuing months it prepared its personal files for the sale. 
The transferred files now include only those concerning corporate clients, and 
employee files containing only essential information—name, business unit, 
position title, salary, preferred language and seniority. All affected employees 
signed an undertaking that they had no confidential government or personal 
information except their own. All personal information contained in filing 
cabinets and work stations was removed to a central repository under the control 
of PWGS where it will be properly maintained or destroyed. And all computer 
memories were erased before being released to St. Joseph Corporation. 


Paying the piper When Bill-C20 cleared both houses of Parliament with no 
privacy protection clauses, the Commissioner initiated a review (under section 
37) to satisfy himself that the transfer of personal data to NAV CANADA 
complied with the Privacy Act. { 
As anticipated, the audit team discovered that most personal records could not 
easily be transferred because they contained an abundance of personal data that 
did not fall within the scope of the transfer protocol. Nor had any attempt been 
made to seek the consent of the individuals concerned. At the 11" hour, 
Transport Canada was required to hire staff and review masses of personal 
documents. (See page 49 for detail). 


While the Office's attention was focused on CCG and NAV CANADA, 
government announcements to privatize or devolve other government programs 
arrived at a steady pace—manpower training programs transferred to the 
provinces and to Indian Bands; airport and port authorities devolved to other 
levels of government or converted to Crown corporations; the St. Lawrence 
Seaway to join ranks with NAV CANADA as a private sector "not-for-profit" 
corporation. And—just passed or on the drafting tables—new agencies to inspect 
our food, collect our taxes, and monitor our health. 


The Commissioner sought the help of the Clerk of the Privy Council and the 
Deputy Attorney General to stem the haemorrhage. He asked for a commitment 
that privacy rules would apply to all new privatization and devolution initiatives. 
He also asked to be informed of any new initiatives at the earliest possible date. 
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A March 17, 1997 letter, signed jointly by the Deputy Attorney General and the 
Secretary of the Treasury Board, advised the Commissioner that: 


" 


. in principle, when programs or services of the federal government are 
privatized or commercialized, continuing protection of personal information 
equivalent to that contained in the Privacy Act should be made part of the 
agreement between the government institution and the private sector entity 
taking over the responsibility. We are working to develop a clear 
government policy statement to that effect. 


In addition, as the government has already committed itself to the 
introduction of legislation in the federally-regulated private sector, it makes 
sense that any newly created federal government institution should be added 
to the schedule of the Privacy Act". 


As we go to press, we have not yet seen a clear government policy on the 
subject, but we can report that Human Resources Development Canada has made 
considerable efforts to ensure privacy protection is addressed in its negotiations ’ 
to devolve responsibility for manpower training. The Canada/Alberta Service 
Centres agreement serves as an example. 

Bill C-60 creating the new Canadian Food Inspection Agency recently passed into 
law. It binds the new agency to the Privacy Act. Bill C-44, the Canadian Marine 
Act, died on the order paper, however, it also contained a provision to make all 
of Canada's major ports subject to the Privacy Act. And the first draft of plans 
to create the new tax collection agency include a provision making the agency 
subject to the Privacy Act. 


It is difficult to understand why ports and a crown corporation like Canada Post 
are subject to the Privacy Act, but not airports, or not-for-profit monopolies like 
NAV CANADA and the St. Lawrence Seaway Authority. Perhaps it's just 
timing—little consideration was given to privacy protection in the early rush to 
privatize—or perhaps the NAV CANADA audit illustrated our point. Whatever 
the reason, the federal government now has in place a more systematic approach 
to privacy protection and privatization. 
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Publicizing the Identity of High-Risk 
Offenders—an update 


Last year’s annual report discussed at some length the challenges of finding a 
balance between society's need to protect itself from violent criminals, and the 
need of individuals who have served their sentences to re-enter society. While 
publicizing some offenders' identity may help the community adapt to the 
person's presence, publicity could increase the risk of harm to, rather than 
protecting, the community. 


Since last report, there have been three developments of note. 


First, Parliament amended the Criminal Code, the Corrections and Conditional 
Release Act and other federal statutes concerning offenders who pose a high risk 
of committing further violent offenses. A court may now designate a person 
convicted of certain sex offenses as a long-term offender, providing certain 
conditions are met. The court must then order the offender to be supervised in 
the community for up to ten years. 


Identifying individuals as long-term offenders gives police and correctional 
authorities the right—and duty—to supervise them in the community after their 
release from custody. Effective supervision by police and correctional authorities 
may reduce the need to notify the community about the presence of an offender 
in their midst. 


The same set of amendments introduced a new provision to the Criminal Code 
allowing Crown prosecutors to ask a court to require a person to enter into a 
recognizance to keep the peace, "be of good behaviour", and comply with any 
other conditions the judge sets out. Prosecutors can use this provision in cases 
where they have reasonable grounds to fear that the person will commit a serious 
personal injury offence. This provision allows some control over violent 
offenders who are released into the community at the end of their sentences. 


Since last year, several provinces have developed protocols, either by law or 
policy statements, establishing when it is appropriate to notify communities 
about the presence of certain released offenders. 


In November 1996, Saskatchewan proclaimed in force The Public Disclosures Act. 


The Act sets in place a means for a police service to ask a "public disclosure 
committee" appointed under the Act to decide whether information about an 


35 


individual should be released to the public, and the extent of the release. The 
police force would make the final decision whether to release the information. 


In April 1997, Alberta introduced a protocol on the release of information that 
would apply to any convicted person judged to pose a risk to others. 
Newfoundland (1996) and Yukon (1997) also introduced protocols. Ontario's 
Community Safety Act, also a vehicle for the release of information about high 
risk offenders, was introduced in the Legislature in 1996, but has not yet been 
enacted. 


Also in April 1997, the Nova Scotia Department of Justice released for discussion 
a draft protocol on disclosure of information about high risk offenders. The 
Nova Scotia protocol proposes to establish a community notification advisory 
committee to which police forces could refer cases. However, the police agencies 
themselves, not the committee, would make the final decision about any release 
of information. 


The difficulty of finding the right balance in the debate over notification is 
illustrated in a recent Ottawa case. A convicted paedophile was released at the 
end of his sentence. Media reports suggested that he was at considerable risk of 
re-offending. His identity was discovered by the community and a newspaper 
published his photograph on the front page. Shortly afterwards, the offender 
moved. His new location was unknown. In fact, he had simply moved from the 
centre of town to a suburb where, despite the media publicity, his criminal 
history remained unknown for months. 


This underlines one of the flaws in publicizing offenders' identity in the 
community. Despite the extensive coverage of his photograph, the offender was 
able to reestablish himself—for several months, at least—in another community in 
the same metropolitan area. Publicity in this case appeared to do little good and 
may have driven the person underground. 


The same case illustrates yet another potential harm from publicity. Eventually, 
the offender's identity was discovered, and he was severely beaten by a local 
resident—a vigilante action that will succeed only in driving the offender to yet 
another community, where he will have an even greater incentive to keep his 
past secret. 


Just before this report went to press, the Commissioner spoke at a national 
conference on community notification in Winnipeg. Conference participants 
discussed the competing interests and examined several notification schemes, as 
well as other legal mechanisms for protecting public safety. We will continue to 
follow the issue closely. 
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This Year's Telecommunications News 


Directory listings: The saga continues 


Last year, we reported on efforts by independent telephone directory publishers 
to buy the electronic subscriber lists of full-service telephone companies. The 
Canadian Radio-television and Telecommunications Commission (CRTC) agreed 
but asked the telephone companies to give their subscribers an opportunity to 
remove their names from the lists before sale to independent publishers. 


White Directories, one such publisher, argued that allowing telephone subscribers 
to opt out of the sale would mean independent directories would be less 
complete than those of affiliated publishers (such as Tele-Direct, Bell Canada's 
directory publisher). White appealed to the Cabinet that it would be at a 
competitive disadvantage. In June 1996, the Cabinet agreed, overturned the 
CRTC decision and asked it to report on two issues: the appropriate level of 
protection to be given to subscriber listings, and the mechanisms for unlisting 
one's name and number from any directory. The CRTC called for submissions 
from interested parties. 


In his September 1996 submission, the Privacy Commissioner observed that most 
telephone subscribers understand that their listings will be used for directory 
assistance and to publish the local telephone directory. However, they are not 
told that the lists are rented and sold to competing publishers and marketers, or 
that their listing is available through call-display and call back options. Those 
wanting an unlisted number are further discouraged by the cost which ranges 
from $1.55 to $5.75 a month. 


The Commissioner recommended that: 
e the telephone companies spell out all the listing options for subscribers; 


e not charge for unlisted service, and 


¢ provide unlisted subscribers with free per-line blocking and ensure the 
blocked listings are only available for emergency and lawful call tracing 
purposes. 


He also urged the CRTC to prohibit other directory publishers from contacting 
unlisted subscribers (using other information sources) to promote listing in their 
directories, and to require them to establish a means for individuals to de-list 
should they choose to at a later date. 
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Of course, suppliers of all telecommunications services assemble lists of their 
clients; companies selling cellular telephones, pagers, PCS, and Internet services 
all assemble customer lists and commercial Web sites maintain lists of site 
visitors. Some of these companies publish or sell their lists. For example, 
America On-Line recently sold its subscriber lists to a list broker—a company 
which specializes in the sale of mailing lists targeted for commercial interests. 


Providers of these services should be required to spell out the primary and 
secondary uses of subscriber listings and seek consent for such secondary uses as 
sale to third parties. 


In its December 1996 report, the CRTC agreed subscribers needed to be better 
informed of their listing options, observed that the privacy of fax and cellular 
subscribers was well protected by existing listing mechanisms, and acknowledged 
that existing costs deterred subscribers from choosing to be unlisted. The CRTC 
will hold public hearings on unlisted charges and the Privacy Commissioner will 
participate. 


Going digital: No miracle privacy solution 


Many readers remember media stories about intercepting conversations on 
cellular telephones. Most existing cellular phones transmit in analog format 
(conventional radio waves) and are easily intercepted using cheap off-the-shelf 
scanners. 


One way to avoid interception of cellular calls is encrypting the signals to make 
them incomprehensible to the interceptor. However, encrypted analog signals 
are easily unscrambled. Another method of protecting one's calls is to transmit 
signals in digital format (the 0-1 binary code used by computers). Digital signals 
cannot be intercepted by analog scanners. But neither is "being digital" the 
ultimate solution. 


Digital signals can be intercepted: Digital scanners, now rare and expensive, 
will gradually become more widely available and cheaper. In October 1996, 
Industry Canada acted on an earlier undertaking and issued Standard RSS-135-1 
obliging digital scanner users to obtain a license. However, the licensing 
requirement will not apply to users of manually-tunable digital scanners, the bulk 
of the digital scanner market. 


Encrypted digital signals can be unscrambled: Although digital encryption is 
far better than analog encryption, it can still be decoded, as proven in March 
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1997 by researchers from the University of California at Berkeley and a private 
U.S. systems company. 


Digital signals do not always remain digital: Digital signals are automatically 
converted back to analog-format if any point on the transmission path cannot 
support digital signals; for example, when the receiver is using an analog cellular 
phone or a conventional analog home telephone. The moment the signals 
become analog, they can be intercepted more easily. (Of course, once the 
conversation is carried on conventional wires, it is protected by the wiretapping 
provisions of the Criminal Code 


These cautions apply equally to all digital wireless services such as Business 
Communications Systems (BCS), Enhanced Specialized Mobile Radio, Local 
Multi-point Communications Systems (Cellular Vision Canada, MaxLink 
Communications and Regional Vision Canada), pagers, Personal Communications 
Systems (PCS), and wireless telephones. 
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In the Courts 


Privacy Commissioner of Canada v. Canada Labour Relations Board et 
al— Court File A-865-96 

In this case, the Privacy Commissioner supports an individual seeking access 
under the Privacy Act to his personal information recorded in hearing notes by 
two members of the Canada Labour Relations Board. The Trial court judge 
rejected the application in June 1996 and the Privacy Commissioner has appealed 
that decision to the Federal Court of Appeal. At issue is the definition of 
personal information, the notion of agency control of that information and the 
nature of the exemptions under the Act. Also at issue is the extent to which 
Board members may claim judicial independence in the same manner as judges of 
the courts. 


Intervenors are the Public Service Staff Relations Board, the Human Rights 
Tribunal, the Canadian International Trade Tribunal, the National 
Transportation Agency of Canada and the Attorney General of Canada. The 
appeal is expected to be heard in the Fall. 


Michael A. Dagg v. the Minister of Finance and Privacy Commissioner of 
Canada and Public Service Alliance of Canada—Court file $.C.C. 24786 
In this case, Mr. Dagg requested access under the Access to Information Act to logs 
signed by employees entering and leaving the Department of Finance, after 
hours. The Minister provided access to the logs but deleted employees' names, 
identification numbers and signatures, considering this information personal. 

Mr. Dagg complained to the Information Commissioner who supported the 
Minister's decision to withhold the information. 


Mr. Dagg applied for a review of the Minister's decision and succeeded at Trial. 
He lost subsequently at the Federal Court of Appeal and has now succeeded in 
this first case to come before the Supreme Court of Canada dealing with personal 
information under the Privacy Act. In a split 5/4 decision, the Court held that 
the information Mr. Dagg sought relates to the individual's position and not to 
the individual. Therefore it falls within an exception to the definition of 
personal information in the Privacy Act and thus may be accessible under the 
Access to Information Act. 


However, the decision is fundamental for the guidance it provides for reconciling 
two apparently competing legislative policies—access to information held by the 
federal government, and protecting the privacy of individuals' personal 
information in those records. The Court stated that both statutes recognize that, 
once information meets the definition of "personal" in s. 3 of the Privacy Act, 
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privacy is paramount over access. Further, the Court held that the general 
opening words of the definition—"...information about an identifiable 
individual..."—are intended to be the primary source of interpretation for what 
constitutes personal information. Justice La Forest continues, "Consequently, if a 
government record is captured by those opening words, it does not matter that it 
does not fall within any of the specific examples" 


Finally, the Court endorsed a deliberately broad definition as consistent with the 
great pains which Parliament has taken to safeguard individual liberty. "Its intent 
seems to be to capture any information about a specific person, subject only to 
specific exceptions...". The Court continues, "Such an interpretation accords 
with the plain language of the statute, its legislative history and the privileged, 


foundational position of privacy interests in our social and legal culture." 
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Incidents 


Tax audit documents found in surplus file cabinet 

A broadcast journalist alerted the office to several taxpayers files found in an old 
filing cabinet. The journalist made two copies of the documents, gave one set to 
the radio station’s legal counsel and sent the second to the Commissioner. The 
originals were returned to the finder who subsequently turned them over to his 


MP. 


Once the Commissioner examined the papers, it was evident that they were tax 
audit files which also contained banking and real estate documents about nine 
taxpayers. The investigator returned the files to Revenue Canada and began an 
inquiry. 


The cabinet appeared to be one of more than 275 sent by Toronto North Tax 
Services to a Crown Assets Distribution Centre between March and June 1996 
for resale. The cabinets were declared surplus following a major refit of offices 
to maximize space and accommodate GST staff being moved from another 
building. Employees affected by the move were temporarily shifted to other 
floors and the surplus cabinets assembled for eventual sale. The buyer purchased 
the cabinet at the Mississauga disposal centre and, on opening it, found 
documents in the first drawer. He then found more documents behind a divider 
in another drawer. Disturbed by the carelessness, he called the journalist. 


Although the investigator could not establish conclusively that the cabinet was 
from Toronto North, it is highly likely. During that move, employees were 
reminded to check their cabinets thoroughly and other staff conducted a spot 
check but did not search every one. Although clearly a human error, Revenue 
Canada has reviewed its operating practices and taken extra steps to prevent a 
recurrence. 


The Commissioner asked Revenue Canada to notify the taxpayers whose files 
were disclosed, apologize and explain the circumstances. He also pointed out 
that the files themselves contained old working papers which do not form part of 
the official audit file. Revenue Canada appeared not to have a retention and 
disposal schedule for these documents and some were kept indefinitely. The 
Commissioner recommended Revenue Canada consult National Archives on an 
appropriate schedule and describe the material in /nfo Source, the government 
directory of information holdings. 
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Canada Post copies courier competitors’ client addresses 

Another journalist alerted the office to a sales blitz going on at the Longeuil 
postal station near Montreal. Apparently keen sales staff were encouraging postal 
sorters and carriers to photocopy the envelopes, or note the addresses, of mail 
from nine competing.courier companies. With the clients’ addresses, the sales 
staff planned to approach the competitors’ clients and try to sell them Canada 
Post services. 


To encourage staff to participate, $1 per prospective client would be paid into the 
appropriate unit’s social fund and, ultimately, names of participating staff would 
be entered in a $50 draw. 


The portfolio officer called Canada Post which immediately acknowledged that 
the promotion was wrong and senior management was taking it very seriously. 
The specific question of whether it was also a violation of the Privacy Act hung 
on whether the addresses were individuals’ homes, rather than business addresses 
and titles. 


While staff pursued this avenue, the Minister was questioned on the incident in 
the House of Commons. She replied that the promotion was an error, an 
isolated incident, it would stop and it would not happen again. The Canada Post 
president obtained written assurances from all vice presidents that this was not 
general practice. The manager and three sales staff were disciplined. And, 
finally, all sales staff will be required to take an ethics course and sign a written 
statement acknowledging that they have taken and understood the course. 


Given Canada Post’s vigorous and speedy action, the Commissioner considered 
the incident resolved. Any individual complaints would be investigated in the 
usual way. 


Stamp collector’s credit card billed for unordered products 

Another Canada Post business practice offended a stamp collector who found 
himself billed for stamps he had not ordered. Although an occasional purchaser 
of Canada Post products, paid for by credit card, he had not ordered the “Winnie 
the Pooh” series: The stamps arrived, billed to his credit card, with an 
explanation that if he did not want them, they could be returned for a credit. 


A journalist called to ask whether this was a violation of the Privacy Act—muisuse 
of the credit card number which had been provided for specific purchases. 
Although the office did not receive a direct complaint, Canada Post did—150 of 
them. 
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Privacy staff undertook to resolve the matter informally. The first hurdle was 
for Canada Post Marketing staff to recognize that misuse of a credit card number 
was a privacy issue. Although they acknowledged the marketing mistake, they 
needed convincing that taking information provided for one purpose, then using 
it for another without the client’s consent, is a violation of the collection 
principles in the Privacy Act. Canada Post’s privacy coordinator undertook to 
explain the principles to marketing staff. 


The second hurdle for Canada Post was to sort out the permutations and 
combinations in client lists. Many stamp collectors have a standing order for all 
new stamps to be billed automatically to their credit cards. Some collectors have 
standing orders but for specific interests—first day covers, special issues, those 
displaying the crown—and may, or may not, want to be alerted to other 
products. Others want to decide on each issue. The standing order lists were 
not always clear. They needed cleaning up, and the options clarified. 


As a result of the incident, Canada Post Marketing is surveying all standing order’ 
customers, explaining the product ranges, and asking them to identify the range 
to which they want to subscribe. This should help prevent customers being 
shipped and billed for products they do not want. 


Health Files in Winnipeg trash bins 
A journalist's call about a discovery of immigration medical files and X-rays in a 
Winnipeg trash bin sent an investigator on site. 


According to the article, the originals of at least 300 preliminary medical 
examinations for individuals seeking entry into Canada were found overflowing 
trash bins in a Winnipeg alley. The documents, dating back to the 1970s and 
early 1980s, were found intact in Health and Welfare Canada envelopes and 
included applicants’ photos, X-rays and personal medical information. 


The medical documents had been placed in two bins behind a townhouse. The 
plastic bags had ripped, spilling some of the contents onto the ground. A 
resident collected the loose material, put it back in the bin and called 
Immigration Canada officials at the Winnipeg Airport, hoping they would 
retrieve it. Not satisfied with their response, she telephoned the Winnipeg Free 
Press and, finally, the police. 


The investigator interviewed several parties and pieced together the story. A 
Citizenship officer received a call from an Immigration Officer at the Winnipeg 
Airport who reported being called about a large amount of immigration medical 
documents in garbage bins. The Citizenship officer went to investigate. 
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He discovered two garbage bins filled with many X-ray envelopes and other 
medical documents, some with photos attached. All appeared to concern persons 
seeking immigration to Canada. Some of the documents bore Health and 
Welfare identification. Unable to find a Health & Welfare contact, he called the 
Winnipeg manager of Citizenship and Immigration Canada, advised him of the 
discovery and later called to advise him that the bins would be emptied the 
following morning. 


The following morning, two Health Canada employees learned of the discovery 
from the newspaper article. Their search for the records lead them through 
garbage bins over a three block area at the site, an attempt to locate the truck 
which had already emptied one bin, and ultimately to the Brady Road landfill 
site. They and two other employees searched the area where the truck had 
dumped but found nothing. Finally, city tractors buried and compacted the area 
so that any records were unlikely to be accessible to anyone. 


Apparently the medical records had been stored at National Archives records 
centre in Winnipeg. The material was due for disposal and after a cursory 
inspection indicated that they contained only X-ray films, they were sold 
through Crown Assets to a local contractor for silver extraction. However, 
instead of providing just the X-rays, Archives turned over envelopes containing 
individual medical files of more than 2,600 potential immigrants to Canada. 


The contractor who purchased the materials for silver extraction got a lot more 
work than he bargained for. He had sorted through approximately 300 paper 
files to extract the X-rays and put the paper in the garbage bins when journalists 
from the Winnipeg Free Press arrived to take photographs. He realized the 
material should not have been put there and went back immediately to retrieve 


the files. 


While the newspaper stories and calls from various government officials unnerved 
the man, he returned all the documents and X-rays to Archives. 


Health Canada had approved the disposal of the outdated records, as had 
Archives which agreed that X-rays of prospective immigrants have no historical 
value. Understanding the records contained only the X-rays, the Records Centre 
manager sent what was described as “1200 lbs of X-rays—silver content 
recoverable” to Crown Assets where the contractor’s bid was accepted. 


An Archives staff member told the investigator that he examined more than ten 
envelopes and they contained only X-ray films, not medical reports. He 
removed any identifying details, marked the material to be disposed of as 
unclassified waste and it was moved to the shredding area. Other staff saw the 
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material with medical documents and photographs stapled to the outside of 
envelopes standing in the area and assumed they were to be shredded. The 
supervisor of the shredding company who was on site also confirmed that the 
skids had been placed in the shredding area and he was told that someone would 
pick the material up. He also confirmed that when the contractor arrived, he 
opened one or two envelopes and was surprised to see medical records in the 
envelopes, saying he thought that he had bought X-ray films. 


The contractor also confirmed that all but two of about 300 X-ray envelopes he 
processed contained medical reports, the majority stapled to the outside. When 
the material was returned to the Records Centre it was found to consist of 
hundreds of loose X-ray films, envelopes and medical reports, as well as more 
than 60 bundles containing an average of 40 to 45 X-ray envelopes each. The 
centre compared the material against the accession shelf lists to verify that all the 
records have been returned. 


The investigator confirmed that, in addition to X-ray films, they contain sensitive 
medical information about prospective immigrants to Canada, including 
applicants’ photos, preliminary medical examination report, radiological reports 
and laboratory test results indicating whether the applicant had such conditions 
as a sexually transmitted or contagious disease. The review also confirmed that 
personal information, such as the individual's name, passport number, 
month/year of birth or age, address, etc., was also contained on the X-ray films. 


The Commissioner found the officials of the Manitoba Region Federal Records 
Centre negligent in their handling of the records and sale of the X-rays. The 
disclosure of this material to the contractor was a direct violation of the 
disclosure provisions of the Privacy Act. The Commissioner made several 
recommendations to the Chief Archivist including 


e suspending all sales of X-rays until new procedures are in place; 
e removing film from the envelopes and destroying any identifying material; 


® requiring contractors and staff having access to X-rays to sign undertakings of 
confidentiality; 


¢ improving record centre staff awareness of what constitutes “personal 
information” and their obligations to protect it, and 


e notifying the Commissioner’s office without delay in similar cases in future. 


The Archivist accepted all the Commissioner's recommendations and also 
suspended further sales of X-rays until the cost of silver recovery made the 
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operation cost-effective. In the meantime, the film will be destroyed in RCMP- 
approved equipment. 


Audits 


The Office has substantially reduced its dependence on audits as a method of 
assessing compliance with the Privacy Act. Systematic auditing has proved 
unsustainable with the Office's dwindling resources. Staff undertook two routine 
audits this year; the Canada Student Loan Program of Human Resources 
Development Canada and the RCMP Public Complaints Commission. A third, 
the Air Navigation System files of Transport Canada, were audited prior to their 
transfer to NAV CANADA. 


Transport Canada - Nav Canada 
Transferring the Air Navigation System (ANS) is one of the federal government's 
largest commercialization projects. The ANS includes seven Area Control 
Centres, 44 control towers, 88 Flight Service Stations and a network of 
navigation aids. It manages all Canadian airspace and designated International 
Civil Aviation Organization airspace in the North Atlantic Region, providing air 
traffic control for approximately 6.8 million aircraft movements annually. Under 
the agreement, NAV CANADA bought all relevant physical assets and assumed 
responsibility for approximately 6,400 employees. 
In mid-1996 the Privacy Commissioner appeared before the Commons Transport 
Committee and urged that NAV CANADA be made subject to the Privacy Act 
to ensure continuing privacy protection for clients and employees. The 
Committee agreed and recommended the government include the provision in 
the enabling legislation. NAV CANADA resisted, the government ignored the 


recommendation and the legislation passed unchanged. 


Given the size of the system and the potential disclosure of vast quantities of 
personal information, the Commissioner launched an audit of the transfer to 
NAV CANADA. In August 1996, staff began examining files in the National 
Capital and Quebec Regional Offices, Ottawa and Dorval air traffic control 
towers and the Training Institute in Cornwall. They identified several problems, 
including substantial amounts of personal information that was outdated, 
information that NAV CANADA did not need and, in some cases, sensitive 
information from managers’ working files that should not have been collected at 


all. 
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However, the most immediate problem was the November 1, 1996 deadline for 
handing over the system to NAV CANADA—not enough time to complete 
what clearly was a necessary review. The Privacy Commissioner wrote to 
Transport Canada's deputy minister setting out the preliminary findings. 
Transport Canada agreed to extend by 60 days the proposed transfer date for 
personnel files and hired 35 temporary clerks to review files and cull extraneous 
information. 


In their preliminary search, staff found virtually all personnel records contained 
information about other individuals—names, Social Insurance Numbers and other 
personal details—often in the form of lists, but also overtime sheets, payroll 
deduction lists and other memos and forms. Much of it concerned people no 
longer employees or who were not being transferred and, therefore, was 
irrelevant to NAV CANADA. And, of course, the individuals had not 
consented to the disclosure. Transport Canada agreed to remove the irrelevant 
material. 


It also agreed to destroy many documents kept in personnel files and managers’ 
working files long after they served any administrative purpose and well past the 
normal retention schedule. These included old disciplinary actions, resolved 
grievances, pay and tax forms, information about family-related leave and 
physicians’ certificates to support employee sick leave. 


Rating files in the Quebec region also included the employees’ conflict of interest 
declarations and post-employment code attestations, neither of which apply to 
NAV CANADA. And the Cornwall Training Institute files held information on 
both successful candidates and others who failed or abandoned courses (many of 
them not ANS employees), some of it dating back to 1959. All this information 
has been removed and given to Transport's information management directorate 
for proper storage or destruction. 


The result: Transport staff removed almost one million pages of outdated or 
irrelevant personal information from the files being transferred. That's 330 
standard file boxes that, stacked one on top of the other, would reach 32 stories 
high. If nothing else. NAV CANADA records managers should be grateful. 


The audit also identified personal data on ANS desktop computers, 3,500 of 
which will be transferred to NAV CANADA. Managers who maintain 
employment records in these computers were asked to remove the data of those 
not transferring. Transport Canada will define limits for access to mainframe 
computers and networks while NAV CANADA and Transport employees 
temporarily share offices and computer systems. 


48 


NAV CANADA has now received the personal information it needs on 
employees who accepted its offers of employment. Transport Canada will retain 
all other personnel files of employees who refused consent to the transfer, as well 
as outdated and other personal information that was removed from the files. 


The good news: a sizeable chunk of Transport Canada files (and virtually all 
NAV CANADA personnel files) have had a thorough housecleaning. Perhaps 
the results will encourage the department to review the rest. Some of the 
problems Transport Canada encountered could have been minimized or avoided 
had NAV CANADA been made subject to the Privacy Act. Waiting until the 
privatization process was well under way before dealing with the privacy issues 
further exacerbated the problent~Involving the Commissioner's Office in the 
process from the outset is one solution but, ultimately, binding these new entities 
to the Privacy Act is a far better one. 


Canada Student Loan Program 

The program is one of those administered by Human Resources Development 
Canada. It now provides interest rate subsidies to financial institutions for loans 
to qualifying students but does not guarantee repayment of loans approved since 
the new Canada Student Assistance Plan took effect. Loans made under the 
previous Canada Student Loan Act will still be guaranteed by the federal 
government. In both cases, defaulted loans may eventually be given to collection 
agencies for recovery. | 


The audit reviewed the public listings in nfo Source, information sharing, staff 
awareness of privacy protection, contracting out, security, use of 
telecommunications to transmit personal information and computers to process 
and store the data. 


The Privacy Commissioner's staff suggested some minor adjustments (which they 
will follow up) but identified no substantive privacy weaknesses. They 
concluded that an intensive audit was not warranted, particularly given the 
government's diminishing role in loans written under the new program. 


RCMP Public Complaints Commission 

The Commission is an independent agency which reviews the RCMP's 
investigation of complaints against its members. It may also receive complaints 
directly from the public, although these too are referred to the RCMP for 
investigation. The Commission has regional offices in Vancouver and Edmonton 
but all complaint reviews are conducted at the Ottawa Head Office. 


Privacy staff found the Commission generally in compliance with the Privacy Act 
but recommended 1t: 
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e seek consent to disclose in its reports personal information that is more than 
required to properly report the investigation; 


e amend the personal information bank description to better describe the 
holdings and the retention and disposal schedules; 


e destroy employment files of former employees held past the approved 
retention schedule, and evaluations of current employees held past the five- 
year period, and 


e retain Members’ notes as part of the Commission's information holdings. 
The recommendation to retain members’ notes could be affected by the Federal 


Court of Appeal decision in the case concerning access to notes of Canada 
Labour Relations Board members (see page 40). 
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Notifying the Commissioner 


Designating a new "investigative body" 

The Justice Department sought the Commissioner's views on designating 
Fisheries and Oceans' Conservation and Protection Directorate as an 
"investigative body" under paragraphs 8(2)(e) and 22(1)(a) of the Privacy Act. 


The effect of this designation is to allow the body to withhold personal 
information from the individual for up to 20 years if it has been collected during 
"a lawful investigation", regardless how trivial, or whether disclosure would harm 
the investigation. In the legal jargon, this is a "class" exemption which—for the 
organization, at least—has the advantage of not obliging staff to review the files 
in response to an access request. Nothing need be released. 


The Commissioner's response minced no words. Acknowledging that an 
individual's right of access had to be balanced against the state's need for secrecy, 
nevertheless he found it “unacceptable for this principle to find expression in any 
statutory provision that does not contain an injury test". He described section 
22(1(a) as "repugnant". 


Despite the favourable findings of a 1996 Justice Department study into 
departments’ use of 22(1)(a), the Commissioner observed that discretion in 
applying the blanket exemption is too rarely used. He cited examples of 
exempted files containing newspaper clippings, and correspondence between the 
department and the subject. While it may be simpler to apply 22(1)(a), "I do not 
believe that administrative convenience should be a consideration...". 


The specific case was "particularly troubling" because the department's request 
had focused on making the case for similar exemption under the Access to 
Information Act. While there may be good reason for a class exemption from a 
general right of access under the Access Act (a matter for the Information 
Commissioner to consider), the application had failed to demonstrate the need to 
withhold an individual's own personal information under the Privacy Act—one 
would argue, a more onerous test. Certainly exemptions should not be invoked 
without considering the individual records and assessing what, if any, harm their 
disclosure might cause. 


The department is reported to be pursuing the application which the 
Commissioner will continue to oppose. | 
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“Public interest” disclosures 

Although the Privacy Act generally prevents government departments and 
agencies from releasing clients’ and employees’ personal information, it lists 
several circumstances which may warrant disclosure. One of these, subsection 
8(2)(m), permits the head of an organization to release information if he or she 
judges the public interest to outweigh any invasion of privacy. The head must 
then notify the Privacy Commissioner who may notify the individual(s) 
concerned, if he considers it appropriate. 


Traditionally the heaviest users of this provision have been Correctional Services 
Canada, National Parole Board, and the RCMP—Correctional Services and the 
Parole Board to release reports on incidents involving inmates and parolees, and 
the RCMP to notify communities about impending release of a dangerous 
offender. 


The number of notifications dropped slightly this year to 63 from 69, due mostly 
to fewer CSC notices. However, RCMP notifications increased to 12 from three 
last year, an increase due in part to delegating authority for these disclosures 
from headquarters to divisional commanders, and in part to a —— public 
outcry about public safety. 

Nine of the notices concerned release of violent offenders in Manitoba 
communities following review by the new Manitoba Community Notification 
Advisory Committee. The RCMP has established its own policy on notifying 
communities about the arrival of violent or dangerous offenders, and several 
provinces have, or are about to establish committees to examine these 
notifications more systematically. For more information on these disclosures, 
(see page 35). . 


Other Matches 


Office staff also reviewed two other data matching proposals, one of which—the 
HRDC student loan match—is ongoing. 


Human Resources seeks student loan defaulters In another attempt to ferret 
out those who owe money to the government, Human Resources Development 
Canada (HRDC) asked Public Works and Government Services to match its list 
of student loan defaulters against the federal government employee database. 
Public Works approached the Office about the request. 


Privacy staff pointed out that although Public Works administers the lists to 
provide pay and benefits services, it does so on behalf of Treasury Board which is 
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the public service employer. The Board is the real owner of the data and would 
have to agree with HRDC in order to submit a matching proposal. Despite its 
repeated verbal assurances that the Board agreed, HRDC was unable to produce 
written authorization. The Commissioner's Office would not consider the 
proposal without the Board’s agreement and there the matter hung at the end of 
the reporting year. 


Agriculture Canada sets off farmers’ debts against benefits 

Agriculture Canada proposed to match landowners’ applications for benefits from 
two programs—the Arable Acres Supplementary Payments Program and the 
Freight Costs Pooling Assistance Program—against lists of farmers owing money 
to other Agriculture and Agri-Food Canada and Canadian Wheat Board 
programs. The cost-benefit analysis identified approximately $900,000 as the 
amount to be recovered and the costs to be negligible as the computer software is 
already configured to run the match. 


The match is not described specifically to Arable Acres Program applicants, 
however, Agriculture staff argued that “set-offs” are described as conditions of the 
program in both the application form and letter setting out the outstanding 
balance owing. 


At one point it appeared that Agriculture was contemplating extending the match 
to other departments to which moneys are owed—apparently including Revenue 
Canada and Veterans Affairs. The Office could accept the specific match within 
the department as a consistent use of the information, but not an extension to 
other unrelated departments. Agriculture staff understood and the data matching 
proposal they eventually submitted was limited to the specific proposal. 
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Investigations Branch 


Complaint intake surged ahead this year setting yet another record—2,235 
received compared to 1,625 last year and the 1700 forecast. Investigators also 
completed 2,717, made possible by a combination of factors; a fast track process, 
a one-time infusion of funds from Treasury Board to hire contract staff (the 
money, and staff, are now gone) and internal re-alignment of staff. As well, one 
complainant withdrew 248 complaints, effectively freeing up two investigators. 


The huge intake hampers the Office's efforts to substantially reduce its open 
caseload, investigators habitually carry an average of 90 open complaints at any 
given time—an excessive case burden. Too much investigator time is spent 
managing files and placating complainants. Caseload, inadequate resources, and 
government cuts in ATIP units, continue to seriously slow the entire process. 


Delays In fact, delays have become endemic in some departments, due to the 
volume and increasing complexity of applications, and staff cuts. The seed of the 
problem was sown in 1983 when departments were told that there would be no 
new resources to handle requests under the then-new Privacy and Access to 
Information Acts. 


Since then, federal agencies have responded to more than 650,000 applications as 
resources have been steadily cut. Unless technology-driven, there are no funds 
available and this work is people-intensive. Managers can only increase efficiency 
to a point—after that functions must be delayed, cut back or cut entirely. The 
ATIP program, not the core function of a department, is often high on the cut 
list. The result; service suffers, so too do the legitimacy and the credibility of the 
program. 


Identifying Access Requesters Once again, the Office has grappled with the 
vexed question of whether identifying those who make Access to Information 
requests to other staff within the department or agency 1s a privacy violation. 
There is an understandable fear of chill—an apprehension that identifying the 
applicant could colour the department's response. Those lcoking for a simple 
answer will be disappointed. 


Investigators have found some instances of departments routinely sending copies 
of the access request (which identifies the applicant) to program staff for a 
response. In some cases these staff had been delegated responsibility to approve 
the response, or to deal directly with the applicant to clarify points or simply to 
speed up the process. When this was not the case, the Commissioner has found 
the disclosure offends the Privacy Act. 
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As a general rule, the applicant's identity should not be revealed to other staff 
who do not need it in order to handle the access request. There may be other 
circumstances in which the disclosure of the applicant's name is justified. 
However, the Office recommended that departmental coordinators consider the 
circumstances of each application carefully to reduce the suspicion that the 
department is manipulating its response. 


Streamlining the Investigation Process The Office continues reviewing and 
streamlining its own processes. During the year it re-grouped the branch into 
two units; one investigates complaints about government collection, use and 
disclosure of personal information, the other, all access-related complaints. It also 
implemented a "fast-track" system to reduce both the administrative and paper 
burden and elapsed time; established quality service standards to reduce the 
resources and turnaround time, improve the quality of the investigations and 
ensure more consistent findings; conducted in-house training to ensure 
consistency and enhance investigative skills, and transferred the Inquiries function 
to the Public Affairs unit to allow Branch management to concentrate strictly on 
complaint investigations. 


Reducing the Backlog In an effort to reduce the backlog of cases—1629 carried 
over from the previous year, the Office has identified all files more than twelve 
months old (578 complaints or 35 per cent of ongoing cases), established a 
Backlog Unit which completed 375 investigations or 65 per cent of total backlog 
by the end of 1996, deployed other professional staff to finalize 
investigations—completing 38 complaints or 18 per cent of the 578 total; 
assigned virtually all time limits complaints to one junior privacy officer—closing 
426 cases, thus freeing up senior investigators for more complex cases. 


While these measures substantially reduced the number of cases open between six 
months and two years, the record intake of new complaints has simply shifted 
the indigestible chunk into the six to 12-month age bracket. 


Cases 


Covering Commissions of Inquiry 

One complaint about disclosures of personal details during the Somalia Inquiry 
revisits a matter about which the Commissioner made recommendations in 
earlier annual reports—that commissions be added to the schedule to the Privacy 
Act. In this case, the inquiry ordered National Defence to turn over virtually all 
information considered relevant to the public inquiry including, obviously, large 
amounts of personal information. 
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DND was legally obliged to provide the material and the Privacy Act permits 
disclosures to comply with warrants or subpoenas. The Commissioner 
concluded that DND had not improperly disclosed personal details. But he and 
National Defence staff were concerned that an individual's control over the 
information is lost once in the hands of the commission of inquiry. 


The Somalia commission assembled more than 100 Document books for legal 
‘counsel and the parties to the inquiry. Once filed as exhibits, the books are 
available to the media. The inquiry staff were conscious of the privacy 
implications of releasing the material and attempted to remove what it considered 
any irrelevant details. However, they are under no legal obligation to do so, 
thus privacy protection will vary from inquiry to inquiry, depending on the 
knowledge, time and inclination of staff. 


Making commissions of inquiry subject to the Privacy Act would not impede 
their work; the act permits disclosures when the public interest "clearly 
outweighs any invasion of privacy that could result". But it would require 
commissions to consider carefully what disclosures clearly serve that public 
interest, and it would provide framework for access, disclosure and retention of 
inquiry material once the inquiry completes its work. 


Canada Post spells out opt-out of Change of Address notices | 
This year the office concluded lengthy negotiations to attempt to resolve two 
complaints about Canada Post's change of address service. 


The service redirects mail from clients' old to new addresses when they move 
(for a fee). Canada Post operates on cost recovery so it offers an address 
correction service to commercial and government mass mailers which (also for a 
fee) updates their clients’ addresses, unless the client actively objects. 


The complainants objected to the feature on the Change of Address Notification 
form telling clients that by signing the form "you consent to the information 
being provided, for address correction purposes, to mailers having your name and 
old address". More detail was provided in some accompanying material which 
the complainants argued was likely to be missed or thrown away in the pressure 
of moving. Assuming clients have given their permission if they are not heard 
from is a common commercial practice known as "opting-out". 


Although technically speaking, there had been no improper disclosures (the 
complainants had opted out) the investigator took up the procedure with Canada 
Post. As part of its modifications to the Change of Address program, Canada 
Post agreed to provide more detail on the form itself and a toll-free line for 
clients to call if they have questions. 
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The Commissioner has made no secret of his dislike of opt-outs as a means of 
obtaining permission. Canada Post argues that the form is already too full to 
allow for a consent box and they are under some pressure from clients who 
frequently complain if they do not receive all their mail at their new addresses. 


Anyone planning a move who objects to their new address being given to mass 
mailers should read the form carefully. Anyone who wants to reduce the 
amount of marketing mail can also use the Canadian Direct Marketing 
Association's Do Not Call/Do Not Mail service at 


1 Concorde Gate, Suite 607 
Don Mills, Ontario 
M3C 3N6 


Guidelines on using program files for employee supervision 

Some government managers have to wear two hats when dealing with employees; 
one as employer and the second as program administrator. Distinguishing 
between the two functions and dealing with the person appropriately can pose a 
challenge. Following a complaint in 1993, Revenue Canada issued guidelines on 
using taxpayer information for monitoring or disciplining its employees; this year 
a similar complaint led Human Resources Development Canada (HRDC) to 
agree to do the same. 


At issue was the employer's investigation of a woman's employment insurance 
(El) claim file which was then used to discipline her as an employee. The 
woman, an insurance agent with the former Employment & Immigration 
Department (now HRDC) developed severe health problems and eventually used - 
up her sick leave. Once her leave was gone, she applied for and received EI 
benefits. 


To speed up her payments, she hand delivered her claims, and those of her son, 
directly to co-workers for manual input to the system. Although caught, 
suspended for eight days and counselled for the conflict of interest, she repeated 
the behaviour. Departmental managers became concerned about her pressure on 
co-workers in general, particularly on one in a trusted position, and examined 
her EI file. Her employment was terminated with an out-of-court settlement. 


The woman complained that HRDC's use of her EI benefits file for employment 
purposes violated the Privacy Act because it meant using information gathered for 
one purpose—to pay her EI claim, for an unrelated use—disciplining her as an 
employee. 


Dy 


The department argued that the Privacy Act allows disclosures specified in other 
acts of Parliament and that it gathered the information to administer and enforce 
the EI Act, an essential component of which is to ensure the professionalism and 
personal integrity of the staff responsible for administering the program. 
Officials also maintained that the use was "consistent with" the original purpose 
for collection—to administer the EI act. The Privacy Act allows consistent uses. 


The Commissioner rejected the proposition that the section of the EI act on 
which the department was relying (section 96) was anything other than a 
confidentiality provision to ensure that EI information was not disclosed outside 
the department. During a subsequent meeting to resolve the disagreement, 
privacy staff suggested HRDC examine the guidelines put in place by Revenue 
Canada to deal with similar extraordinary situations; examining an employee's 
income tax return. 


At issue is not whether a department can discipline its employees for conflict of 
interest or other infractions, but ensuring that program files do not become a ‘ 
routine part of employee supervision. The circumstances which justify this use 
of non-employment information should be serious, the access restricted and the 
authority clear. 


Office staff offered their advice and support in drafting appropriate controls. The 
department agreed and the Commissioner looks forward to seeing the results. 


RCMP’s disclosures during investigation “excessive” 

‘A complaint from a lawyer challenged the information the RCMP revealed to 

_ several organizations about his client whom it was investigating. He argued the 
disclosure was excessive and in violation of the Privacy Act. 


In an attempt to gather evidence for an investigation into alleged fraud and 
misappropriation of federal funds, the RCMP wrote to nine organizations 
seeking copies of any contracts they entered into with the individual and details 
of any disbursements they made. The letters disclosed information about the 
investigation, in particular that “evidence uncovered to date is overwhelming and 
prosecution will be unavoidable”. The individual also complained to the RCMP 
Public Complaints Commission. 


The RCMP should be able to demonstrate that its disclosures of personal 
information during investigations are required to fulfil its law enforcement and 
investigation mandate. During the Public Complaints Commission investigation, 
the RCMP acknowledged that the reference to the prosecution was unnecessary 
and apologized to the complainant for any discomfort this may have caused. 
Thus, by its own admission, the disclosure was excessive. 
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The privacy investigator reviewed the files, located the letter but could not find 
the same or similar statement in any of the preceding volumes. The comment 
first appears in the letter and seems to be the opinion of the writer. The RCMP 
agreed that the statement was unnecessary, improper and “lacking in tact”. The 
RCMP Commissioner undertook to ensure that proper training is available to all 
members who must secure evidence from outside bodies during economic crime 
investigations. 


The Privacy Commissioner concluded that the complaint was well-founded but 
regretted that nothing further could be done to remedy the situation. 


HRDC disclosures to private training companies tightened 

One of the most immediate and visible signs of contracting out government 
services 1s the training courses offered employment insurance claimants. The 
courses, once given by Human Resources Development Canada, are now 
contracted out to private training organizations. This often comes as a surprise 
to the claimants who wonder where the company got their information. 


A case in point was an Alberta woman who left her job to accompany her 
husband who was attending university in another city. She applied for 
employment insurance two weeks before the move and gave her new address. 
Shortly after moving she received a call from a company offering her a three 
week course, paid for by the department, on “employment issues”. Taken aback, — 
she asked how they got her information and whether they were a private 
company. The company explained its status and role but the woman was 
“astounded” at the disclosure of the information outside the department. 


The Employment Insurance Act allows the department to disclose information to 
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persons as the Minister deems advisable”. The investigator confirmed that the 
then-minister had signed an authorization to release information to contractors 
for purposes specified in the contract. The department had entered into a 
contract with the company which had called the complainant to provide training. 


In an attempt to increase participation in the training, the department gave the 
names and telephone numbers of targeted EI applicants to the company which 
would market the course directly to applicants. The department did not tell the . 
applicants or ask their consent for the disclosure and there was no mention of it 
in the supporting materials. The course was voluntary and the woman was not 
interested in its content, the focus of which was to help EI recipients deal with 
the personal changes, brought on by job loss that “negatively impact on their 
ability to become re-employed”. Since the training was not mandatory and the 
contract did not permit disclosure of personal information for marketing the 
course, the Commissioner concluded that the woman’s complaint was well- 
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founded. The investigator also found that the contracts contained no clauses 
protecting the personal information once in the hands of the company. 


As a result of the woman’s complaint, the Canada Employment Centre now 
consults clients before giving their names to private contractors for training. The 
description of the information and its uses in /nfo Source will be amended, and 
the EI application form has been changed to describe the potential use of 
claimant's information for training purposes. And, most important, 
Employment Centres have been instructed to ensure that contracts now contain 
clauses to protect clients’ personal information. With these steps, the 
Commissioner considered the complaint resolved. 


Lost file prompts new tracking system 

A Second World War veteran's request for his medical file to support a disability 
pension application revealed that the file was apparently lost. When neither 
National Archives (which stores all old government personnel and military 
records) or Veterans Affairs could find the file, he complained to the 
Commissioner. 


The veteran's original request went to Veterans Affairs. Since the file was more 
than two years old, the request was transferred to National Archives. Archives 
found the file was missing but did have a copy of a form indicating that it had 
been loaned to Veterans Affairs in 1987. Apart from keeping the form, Archives 
had no process to follow up and ensure that the file had been returned. 


Veterans Affairs normally photocopies original files in Ottawa, returns the 
original to Archives, and forwards the copies to the appropriate regional office. 
It too found no trace of the file and believed it had been returned. Although a 
computerized system now tracks files borrowed from and returned to Archives, 
it was started in 1991. Any paper records from 1987 would have been destroyed 
as part of normal record review and destruction. 


When the complainant produced a letter from the Royal Canadian Legion stating 
that staff had reviewed his file in 1988 to help him with his pension application, 
the investigator contacted the Legion. The Legion was happy to try to help but 
it was apparent that its staff only review original documents on site in 
government offices and take copies of the needed documents; they do not receive 
originals. Fortunately the copies they had taken were helpful. The investigator 
followed another possible lead to the Surgeon General's office at National 
Defence but it too was cold. 


The investigator had to conclude that the file was gone or misfiled in Archives' 
huge inventory and too much time had elapsed for there to be any hope of 
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finding it. Had Archives file loan controls been better, the loss would have been 
noted much earlier and the chances of recovery far greater. Although little could 
be done to solve the immediate problem, the Commissioner wanted some 
assurance that the incident would not be repeated. 


The investigation led Archives to initiate a file recall system for loans to other 
departments. The departments will now receive a formal recall notice at 90 days, 
and at 120 and 180 days if there are valid reasons for keeping the file longer than 
90 days. The Commissioner concluded that the complaint against Archives was 
well-founded but, with the file recall system, now resolved. He dismissed the 
complaint against Veterans Affairs. 


Complainant was source of personal details 

It is evident that people often don't understand the implications of borrowing 
money and the collection and disclosure of personal information that is an 
integral part of the process. A man complained that a letter to him from a law 
firm about his unpaid Canada Student Loan contained information about his 
defective heart condition and his Social Insurance Number. He wanted to know 
how they got the information. 


The man had defaulted on the loan and Human Resources Development Canada 
(HRDC) turned the matter over to a collection agency—the law firm. The firm 
obtained a credit report from Equifax (a major credit bureau) which contained | 
the medical information, the name of his doctor, and the notation that the 
information was provided by the man himself during an interview. 


Student loans are like commercial loans. The student borrows the money from a 
financial institution and authorizes the lender to exchange with credit bureaus, 
credit granters and credit reporting agencies information about the loan. This is 
part of the bargain between borrower and lender. The student loan program acts 
as guarantor for the bank. Ifa student defaults, the bank is paid by the 
government which then attempts to recover the money owing. 


The law firm was acting as the department's agent in its attempt to get the loan 
repaid and had a legitimate reason to obtain the credit report from Equifax. In 
fact, the law firm acted in the complainant's interest when it explained to him 
that HRDC might defer its collection if he could provide information to confirm 
that his disability prevented his working and therefore repaying the loan. 


The department also demonstrated that the Canada Student Loan Program is one 
of the federal activities legally mandated to use the SIN and, as its agent, the law 

firm had a right to it. The SIN was also in the man's Equifax file. Use of SINs 

by credit agencies is the single biggest motivator for private sector requests for 
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the number and is outside of the federal government's jurisdiction. The 
Commissioner dismissed the complaint. 


Should employees expect privacy for their e-mail? 

An employee of a Correctional Service Canada (CSC) treatment centre alleged 
that the secretary of the division had obtained her computer password and 
accessed her e-mail without consent during her absence. She complained that the 
access breached her privacy and that of inmates whose personal information was 
in her data base. 


The investigator established that CSC headquarters had called for a copy of a 
document the complainant had prepared but it had not received. The request 
was urgent, the complainant was absent but her secretary knew it had been sent 
and could be found in her e-mail. She asked the divisional secretary for help. 
Informatics staff suggested re-setting the complainant's access code to allow the 
secretary to obtain the document. The Assistant Warden gave the secretary 
permission to re-set the code in order to access the e-mail. 


The complainant argued that a copy could have been obtained from another 
office. She suspected that her supervisor wanted access to her communications 
with a union representative and another employee concerning her harassment 
complaint against him. In fact, only her secretary entered her computer and she 
insisted that she did not browse through the e-mail or any personal files. She 
knew approximately when the e-mail had been sent and found it quickly. 


The investigator found no evidence that there had been any improper disclosure 
of personal information. Computer passwords are the equivalent of locks and 
access lists for conventional paper records; they are to prevent unauthorized 
access by individuals who have no need to examine information in employees' 
working files. However, no matter the medium, information employees prepare 
for government business and stored on government premises should be available 
to an individual's supervisor if there is a demonstrated need during an employee's 
absence. 


The Commissioner agreed with the complainant that access should always be 
controlled and authorized by the employee's supervisor. As a result of the 
complaint, CSC informatics staff now require a written authorization from a 
supervisor before re-setting passwords. 


Managers and employees alike should remember that e-mail is not secure and 
even deleted e-mail messages can sometimes be retrieved. In short, these systems 
should not be used to send or store anything they don't want others to read. 
The complaint was not well-founded. 
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Tax reassessment of travel allowances no “fishing expedition” 

Several RCMP members complained to the Commissioner that by giving 
Revenue Canada a list of those receiving transfer allowances from 1991 to 1993, 
the RCMP had improperly disclosed personal information. (They also 
complained about Revenue Canada’s collection of the information.) The 
complainants argued that the request was akin to a “fishing expedition” and that 
Revenue Canada was obligated by the /ncome Tax Act to obtain a judge’s order 
to obtain information about unnamed individuals, and the RCMP should not 
have relinquished the list without one. 


At issue is the allowance paid to RCMP members when transferred to a new 
location. The allowance, equal to 1/12 the annual salary, is to be taxed at source 
by the RCMP and reported by members as a taxable benefit on that year’s 
income tax return. Members are told this when paid the allowance. In contrast, 
actual moving expenses are fully deductible with receipts. 


A Revenue Canada audit of Regina District RCMP members revealed that many 
were simply deducting the full amount of the allowance as a moving expense. 
Auditors also discovered that the RCMP had not properly reported the taxable 
allowance on members’ T4 slips. If it had, Revenue Canada could have found 
any discrepancies from its own computer system and not needed the RCMP’s 
list. Once Revenue Canada discovered the omission, it asked the RCMP for the 
lists to conduct a random sampling to determine the extent of the problem. 
Following a telephone conversation between the RCMP Commissioner and the 
Revenue Canada Deputy Minister, the RCMP agreed to turn over the necessary 
records to ensure that transfer allowances were being properly reported. 


Revenue Canada reviewed the computer tape and examined the returns of all 
members who received the transfer allowance during the three years at issue. Of 
the 1400 returns, 633 were reassessed and $1,227,000 in unpaid taxes was 
recovered. The remaining returns were processed with no changes, either 
because the member did not claim the allowance or the return had already been 
re-assessed by a field office in the post-review process. 


It was clear to the Commissioner that both departments were cognizant of the 
restrictions in both the Privacy Act and the Income Tax Act, had sought legal 
advice and proceeded carefully. The RCMP is required to report properly to 
Revenue Canada any benefits paid its employees. Rather than ask the RCMP to 
re-issue T4 slips to all its members for the relevant years (which would have 
triggered a review of every member’s file) Revenue Canada focused its request on 
a list of only those who had received the transfer allowance. The Commissioner 
concluded that Revenue Canada is entitled to collect the information under the 
Income Tax Act and therefore there was no violation of the Privacy Act. 
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Air crew remarks to safety inspectors given to airline 

The disclosure of an employee’s critical comments to the employer can have 
predictable consequences and require a careful assessment of whether the remarks 
are simply letting off steam, or information to which the employer is entitled. 
This was evident when the flight service director of an Air Canada cabin crew 
allegedly told a Transport Canada inspector that a number of the shortcomings 
she noted on the trans-Atlantic flight were due to the airline emphasizing service 
over safety. The inspector paraphrased all the crew members’ remarks and 
relayed them to the airline in her report. The report led the airline to correct 
the deficiencies and to take disciplinary action against the flight director. He, in 
turn, complained that the inspector’s disclosure was improper. 


The investigator found that the inspector had noted numerous violations of the 
Aeronautics Act, Air Regulations and related Air Navigation Orders. Normally 
inspection reports are sent monthly to appropriate airline personnel. Only when 
inspectors note “extensive non-conformities” do they issue separate letters of 
finding. The inspector’s letter noted both the specific violations and her 
interpretation of the flight director’s remarks that the company should be blamed 
for the non-conformities, not him, since cabin crew had been complaining for 
some time about service considerations overriding safety procedures. The flight 
director said his comments had been misinterpreted. 


Airline inspection personnel find interviews with flight crew a valuable source of 
information since crew often voice concerns to inspectors they would be 
reluctant to express to their employer. Open communication between inspectors 
and crew is essential. However, safety comes first. When inspectors find cabin 
crew not complying with safety requirements, they must report this to airline 
management. Management, in turn, must respond in writing to Transport 
Canada on its corrective action. As well, the flight director has overall 
responsibility for service, safety and cabin crew and is subject to disciplinary 
action when there are extensive violations. Although airlines usually determine 
the disciplinary action, Transport Canada can make specific Se eee and 
recommendations. 


It was evident from the legislation, regulations and procedures manuals that 
Transport Canada has authority to inspect flight safety and communicate its 
findings, including relevant crew comments, to the airlines. The inspector 
considered the crew’s comments were relevant to flight safety and required by 
the airline to correct the shortcomings. The Commissioner concluded that 
Transport Canada has clear legislative authority for safety inspections and that 
the inspector disclosed the crew’s remarks for the very purpose for which they 
were gathered—to deal with safety violations. Thus there had been no violation 
of the Privacy Act. 
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Nevertheless, the Commissioner agreed that paraphrasing the crew’s remarks 
risks misinterpretation, particularly when the crew does not see the written 
report and thus has no opportunity to correct misunderstandings. The 
comments are often gathered while flight crew are busy on descent which may 
prompt less than careful remarks. The Commissioner recommended inspectors 
have an opportunity to share written findings with aircrew before submitting 
them to the airline. He also recommended inspectors make a greater effort to 
record the crew’s comments verbatim to avoid misinterpretation. 


Instructor circulates students’ information 

A student on a course at a private training centre under contract to Human 
Resources Development Canada (HRDC) complained that the instructor had 
circulated a list of the students’ names, addresses, telephone numbers and Social 
Insurance Numbers for each student to verify the information. Circulating one 
list effectively disclosed her personal details to each of the other students. She 
thought there should be some penalty against the centre. 


There was no doubt that the private training centre was under contract to 
HRDC and thus bound to respect the Privacy Act. Nor was there any dispute 

_ that the information had been disclosed. The investigator interviewed the 
instructor who confirmed that HRDC had advised her that she was responsible 
for protecting her students’ personal information. She confirmed that the centre 
would use individual sheets in future. 


The investigator explained to the complainant that there are no penalties against 
the training centre—HRDC 1s held responsible for the actions of its contractors. 
The complaint was well-founded. 


Request for Archives investigation not "personal" 
A letter asking the National Archivist to investigate allegations of improper 


document destruction at National Defence prompted a complaint from the writer 
that the letter should not have been disclosed to DND. 


The letter set out the writer's allegations, named DND sources who could 
provide information, and asked the Archivist to investigate. Since National 
Archives does not have the power to enter a department and investigate on its 
own right, the Archivist wrote to the Deputy Minister of National Defence 
enclosing a copy of the letter, and asking him to investigate the allegations. 


The complainant argued that the letter contained confidential and personal 
information, including the name of his sources, which should not have been 
disclosed, and that his own privacy had been violated by Archives' release of his 
letter to DND. 
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The Archives argued that the letter was on company letterhead and therefore did 
not appear to be personal, the writer had not asked for confidentiality (a request 
made—and respected—in an earlier letter), the Archivist could not investigate 
without the full cooperation of DND, and the department could not investigate 
without knowing the allegations against it. 


The Commissioner concluded that the writer clearly wanted Archives to 
investigate and had provided the information in order for it to do so. Archives 
has no investigative power of its own and, therefore, it was reasonable that it 
should provide the allegations to DND for it to investigate. In effect, Archives 
used the information for the purpose for which it was provided. 


It is also a fundamental principle of natural justice that an accused be able to face 
the accuser and know the charges being made. This is true even of complaints 
under the Privacy Act—the complainant's name and allegations are given to the 
department cited. The Commissioner considered the complaint not well- 


founded. 
Inquiries 


This year's inquiries exceeded 9600 for the first time. Inquiries range from 
straightforward questions about the Privacy Act, to how to get a pardon, remove 
names from mass mailing lists, or find natural parents. And each time the federal 
government launches a new program or begins another collection of personal 
information—the last census, the Consumer Price Index survey, or matching 
Customs and EI data—the telephones start to ring. 


A substantial segment of the work deals with referring callers to organizations 
which may be better placed to help. Clearly a number of callers are frustrated to 
discover the limit of the Commissioner's mandate and angry that, in fact, there is 
no legal protection for their privacy. We encourage them to support the 
government's initiative to have national privacy legislation in place by the 


year 2000. 


About 40 per cents of the inquiries are in the Commissioner's jurisdiction and 
focus on using and interpreting the Privacy Act. The next largest group, requests 
for Office publications and calls from the media, makes up 18 per cent. Referrals 
to our provincial counterparts count for eight per cent and complaints about uses 
of the Social Insurance Number seven per cent (see below). The remaining 27 
per cent concern such issues as telemarketing and direct mail, adoption, 
geneology, credit reporting, financial institutions, and medical records. 
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Hydro Québec asks new customers for SIN 

Many Canadians view the federal government as the custodian and supervisor of 
the Social Insurance Number, and the federal Privacy Commissioner as its 
national guardian. In fact, neither is true. The federal government has a strict 
policy on its own uses.of’the ubiquitous SIN but no power to control how 
others use it. A case in point is Hydro-Québec's request for SINs from new 
customers which prompted a deluge of calls demanding that the federal 
Commissioner intervene because it is a "federal number". 


The Québec Information and Privacy Commissioner and Hydro-Québec (which 
is subject to the provincial privacy law) debated: the issue at some length and 
appeared headed for court. By mutual consent both parties agreed to step back 
and find a solution with which both could live. Hydro-Québec convinced the 
provincial commissioner that using SIN was the only way to track down 
customers who move without paying their bills. The commissioner, in turn, got 
Hydro's agreement to create a new unique ID number from the SIN, remove 
some gratuitous personal details from its files and allow only its collection staff 
access to the actual SIN. In May 1996, the Quebec National Assembly passed 
Section 8 of Hydro-Québec By-Law 634 giving the corporation the right to 
request SIN from customers "opening an account". Once Hydro began advising 
its customers that it might ask for their SINs, the phones began to ring. 


The federal Privacy Commissioner continues to object to compelling people to— 
provide their SIN for uses completely unrelated to their original purpose. 
However, given that Hydro-Quebec's by-laws now require the SIN, its customers 
have no legal grounds for refusing. 


New Permanent Register for Electors 

The office also received several calls from individuals upset with Elections 
Canada's request for their date of birth on the enumeration form for the new 
permanent voters register (see page 19 for more detail). Elections Canada collects 
the birth date and gender to help it distinguish between individuals with the 
same or similar names. The information does not appear on the lists given to 
political parties each year. Inquiries officers explain that the register is protected 
under both the Privacy Act and the Elections Act and voters do not need to be in 
the register to vote. Voters also have the right to withdraw their names or to 
prevent their transfer to the provinces or territories by writing to the Chief 


Electoral Officer. 


Errors on credit files 

We continue to receive many calls from individuals who are concerned about 
errors on their credit files. Credit bureaus in Canada are private businesses and 
therefore are not covered under the Privacy Act. They are regulated by 
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provincial consumer protection laws so the details of the parties’ rights and 
responsibilities vary from province to province. Individuals who have not been 


able to have errors corrected by their local credit bureau should contact their 
provincial agency which administers consumer protection law. 
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Completed Complaints by Department and Result 
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Completed Complaints 1986-97 
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International Privacy Commissioners Meet 
in Ottawa 


Last September, the Office hosted the 18"? International Data Protection 
Commissioners Conference in Ottawa. The conference, which began as an 
informal annual meeting of Western European data protection and privacy 
commissioners, has evolved into an event to exchange information and examine 
the privacy implications of new trends, techniques and technologies. 


The 1996 conference attracted 300 provincial, territorial and foreign 
commissioners and for the first time a large contingent of government and 
industry representatives and privacy protection advocates from around the world. 
The commissioners represented 23 countries and 17 sub-national jurisdictions (for 
example, Canadian provinces and German states). 


The 1996 Ottawa conference theme, Privacy Beyond Borders, focused on the 
privacy impact of growing international trade in personal information. The 
Ottawa conference offered the first opportunity to attract a sizeable North 
American contingent, as well as participants from other countries interested in 
the North American approach to data protection. 


The first two days of the three day conference were open to all participants and 
consisted of presentations and panel discussions. The last day was a business 
meeting for privacy commissioners and their staffs to exchange views on 
administrative, legal and policy issues common to their operations. Among the 
topics debated at the public meetings were: 


e the new European Union Directive on the protection of data and privacy, 
and its impact on North American businesses; 


° increasing surveillance of individuals, including workplace monitoring and 
the use of information relating to a person's whereabouts; 


e international developments in data protection and privacy legislation; and 


° privacy and selected Canadian private sector industries. 


These annual conferences serve many purposes, most important of which is 
sharing experiences with privacy issues that increasingly respect no national 
boundaries. Canada can learn much from other countries’ privacy initiatives, and 
our own privacy bodies have much to share with other jurisdictions. In an 
environment in which increasingly scarce public resources are being shifted to 
programs and systems that threaten to erode privacy, few are available for its 


74 


protection. The data protection commissioners conference offers the prospect of 
some synergy. 


Many of the papers presented at the conference are available on our Internet web 


site at http://infoweb.magi.com/ ~ privcan/. The office also has available a limited 
number of bound copies of the papers. 
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Privacy Protection In Canada...an update 


British Columbia will begin reviewing its Freedom of Information and Protection 
of Privacy Act later this year. The Legislature is expected to appoint a Special 
Committee that will report back to the Legislative Assembly within one year on 
the results of its review, including any recommended amendments. 


There was some concern that the government might amend the act before the 
committee completed its review. The government now appears to have 
postponed any such plans and will allow the committee to hear representations 
before considering any changes. 


Alberta introduced Bill 1 to extend the Freedom of Information and Protection of 
Privacy Act to schools, health authorities, post-secondary institutions and ~ 
municipalities. The bill allows local public bodies to be phased into the act, 
sector by sector, as they are ready. The education sector is expected to be the 
first new group brought under the legislation, followed by the health sectors and 
the municipalities. 


The government also released a discussion paper entitled Striking the Right 
Balance as part of the process of preparing new health legislation. At issue is the 
balance between sharing information to improve health and health care while 
protecting the privacy of an individual's personal health information. Results of 
the consultations will lead to draft legislation to be introduced later in 1997. 


Manitoba is planning to table a new freedom of information and protection of 
privacy bill to replace the 1988 Freedom of Information Law which deals only 
with access to personal records. The new bill would include a fair information 
code—rules for government collection, use and disclosure of residents’ personal - 
information. It would also address the impact of growing application of 
electronic technology on information rights. 


In addition, the province is considering a separate medical privacy protection bill 
to strengthen health privacy provisions across many different statutes, and to 
respond to growing concerns over protecting personal health information with 
the advent of new health information-sharing technologies. 


In July 1996, the New Brunswick Ministry of Justice released a discussion paper 
seeking comments on a proposed Privacy Act. This new law, somewhat similar 
to the federal law, would replace the December 1994 voluntary Privacy Code and 
apply to provincial government records. Like the code, the law would be 
overseen by the province's Ombudsman. 
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The Northwest Territories’ Access to Information and Privacy Act came into 
force in January 1997. In anticipation of the April 1999 splitting of the 
Territories to create Nunavut, however, minor changes were made to the law 
before it came into force. The Information and Privacy Commissioner will be a 


private sector specialist instead of a government employee, and his/her term will 
end in March 1999. 


In March 1996, the Nova Scotia advisory committee reported on its review of 
the province's 1993 Freedom of Information and Protection of Privacy Act. The 
committee made 65 recommendations including extending the act to private 
businesses under contract to the provincial government, to academic institutions, 
and to municipal and regional agencies, and appointing a commissioner to replace 
the existing part-time Review Officer. | 


Ontario's February 1996 omnibus bill brought changes to its Freedom of 
Information and Protection of Privacy Act. Applicants must now pay a $5 fee to 
examine their own information, and a further $10 if they wish to lodge a privacy 
complaint with the province's Information and Privacy Commissioner. The Bill 
also allows an institution to refuse to respond to requests which the head has 
reasonable grounds to believe are "frivolous or vexatious". 


Another bill amended the provincial law to remove from its application any 
records an institution collects, maintains or uses concerning communications, 
consultations, discussions, meetings, negotiations or proceedings about labour 
relations or employment-related matters in which the institution has an interest. 
These changes could deprive provincial employees of much of their right of 
access to, and correction of, their personal information. 


Quebec's Bill 32, enacted in June 1996, somewhat weakened that province's 
privacy law by furnishing the provincial Ministry of Revenue unprecedented 
powers to obtain personal information from other provincial and municipal 
agencies to catch "tax cheats". The Ministry must notify the provincial Privacy 
Commissioner who will monitor but may not stop the collection. As well, 
Québec set up a province-wide prescription drug network which became 
operational in January 1997, stirring some privacy concerns. The province also 
announced that, beginning in 1998, it would replace existing health care cards 
with smart cards, although these would not contain a person's medical record but 
act as a key to centralized computer files. Lastly, Quebec's National Assembly 
held a series of public consultations in March 1997 on the need for a provincial 
identity or multi-purpose card. No recommendations have been made to the 
government to date. 
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Yukon has enacted a revised access to information law which now includes 
provisions for protecting territorial residents’ personal information and privacy. 
The new law is overseen by the territorial Ombudsman, who doubles as 
Information and Privacy Commissioner. 
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Corporate Management 


The Offices of the Information and Privacy Commissioners share premises and 
administrative support services while operating separately under their statutory 
authorities. These shared services—finance, personnel, information technology 
advice and support, and general administration—are centralized in Corporate 
Management Branch to avoid duplication of effort and to save money for both 
government and the programs. The Branch has just 15 staff and a budget of 
approximately 15 per cent of total program expenditures. 


Resource Information 


The Offices' combined budget for the 1996-97 fiscal year was $6,657,000. Actual 
expenditures for 1996-97 were $6,669,015 of which personnel costs—$5,452,166, 
and professional and special services expenditures (contractors and outside legal 
counsel) $721,248—accounted for more than 93 per cent of all expenditures. 


The remaining $495,601 covered all other costs including postage, 
telecommunications services, supplies, equipment, travel and printing for both 


programs, the 84 employees and two Commissioners. 


Actual expenditure details are reflected in Figure 1 (Resources by 
Organization/ Activity) and Figure 2 (Details by Object of Expenditure). 


Figure 1: 1996-97 Resource Use by Organization/Activity 


Human Resources Financial Resources 
(Full-Time Equivalents) ($000) 
Information Information 
33 (38%) 2668 (40%) 
Administration Administration 
| 15 (17%) 924 (14%) 
Privacy Privacy 
38 (44%) 3077 (46%) 
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Figure 2: Details by Object of Expenditure 


Information Privacy Corporate Total 
Management 

Salaries 1,996,206 2,169,513 593,447 4,759,166 
Employee Benefit Plan Contributions 277 ,000 323,000 93,000 693,000 
Transportation and Communication 48,979 59,566 128,191 236,736 
Information 255531 66,867 2,010 92,408 
Professional and Special Services 259,691 421,326 40,231 721,248 
Rentals 3,863 14,316 14,653 32,832 
Purchased Repair and Maintenance 12,515 2,130 7,356 22,001 
Utilities, Materials And Supplies 30,418 13,042 35,738 T9198 
Acquisition of Machinery and Equipment NaS; 105 5,693 be oy 30;133 
Other Payments 655 1122 516 PMO by 


Total 2,667,963 930763979 24 ATT 6,669,015 


Expenditure Figures do not incorporate final year-end adjustments reflected in the Offices’ 
1996-97 Public Accounts. 
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Some Unfinished Business 


This annual report marks both the end of my seven-year term and the 
beginning of a two year extension. It seems an appropriate moment to 
express my gratitude to Parliament for this opportunity to deal with 
two pressing issues. The first 1s seeing an effective and enforceable pri- 
vacy law in place in the private sector. The second: ensuring that the 
planned health information infrastructure does not lead to open season 
on patients’ medical information. About which, more in a moment. 


Certainly the information landscape has been transformed during this 
term but it is a transformation well underway seven years ago. 
Computer technology led the revolution in information management, 
bringing with it all the promise and peril of massive new collection 
and use of personal information. All the prophecies made at the time, 
both for good and for ill, have been borne out. The personal informa- 
tion of millions of people is being collected, manipulated, massaged, 
bought and sold, used and abused at a rate now many times faster than 
was possible seven years ago. 


We have seen the maturation of perhaps history’s greatest and poten- 
tially most liberating communications system, the Internet. Millions 
more users join the Net each year, and surely it will soon become as 
much a commonplace as — and may well supplant — the telephone 
for much of the world’s commercial transactions and personal 
communications. 


But Internet has also brought new problems; threats to privacy, decency 
and truth (and possibly to individual safety). With the abuses comes a 
corresponding effort by society generally, and governments particularly, 
to gain some control. Some of these efforts, such as those aimed at 
eliminating the traffic in pornography, are entirely commendable. 
Others are unappealing. One of the latter is the government’s appetite 
to control and override encryption, the most-promising technique for 
assuring adequate privacy for individual users and security for electron- 
ic commerce. Strong-arm initiatives such as these might well prove a 
suffocating inhibition, and destroy much of Internet’s value as an open 
and wonderfully flexible method for the world to communicate. 


Meantime, the drift toward increasing surveillance of our society has 
become a flood. Almost every day, we read of more spy-cameras 1n 
another community. More streets, more businesses, more workplaces are 
subjected to the baleful stare of these electronic Little Brothers. As 
usual, the surveillance is done in the name of greater security and safe- 
ty. Sometimes it may even be justified. More often it is not, witness the 
recent decision of one bar owner to install cameras to record the 
unruly behaviour of some patrons. 


This pervasive surveillance signals a rapid approach to rock-bottom 

in our respect for individual rights. Easier to resort to a quick surveil- 
lance fix and diminish everyone’s right to some private enjoyment, 
rather than accept responsibility for maintaining a civilized atmosphere 
by refusing admission to, or turfing out the rowdy. But even more 
depressing 1s our uncritical acceptance of this spreading surveillance. 
We can achieve perfect safety and security to be sure. And, of course, 
we have nothing to hide. All we have to do is give up any notion of 
personal freedom. 


On the Road to Damascus 


The past seven years have brought one signal change; that is in my 
views on how best to face the mounting challenges to preserving 
privacy rights. My first annual report expressed a scepticism about 
the need for stronger privacy laws and “some hope yet for the path 
of voluntary action”. 


That hope did not long survive. By 1995 I confessed “Reluctantly, and 
by stages” to having concluded that “voluntarism is inadequate”. I 

pressed for both federal and provincial action to bring the private sec- 
tor under the umbrella of privacy laws. (Quebec had already done so). 


This evolution in thinking occurred partly (but not entirely) because of 
the inadequate response of the private sector. Other important influ- 
ences were at work. These include growing government and private 
sector exchanges of information, privatization of government opera- 
tions with the resulting loss of existing privacy protection, and the 
developing European Union common data law which risks restricting 
information flow to countries with inadequate private standards — of 
which Canada 1s one. 


By 1996, the government had reached the same broad conclusions. 
This happy event perhaps was not born solely out of concern for an 
individual right, but also due to a determination to see Canada ahead 
of the pack in developing electronic commerce. One is an inevitable 
consequence of the other; Canadians will not shop, bank and file 
taxes on line knowing they risk sharing their lives with more than 
40 million people. 


While we may quibble over the motivation, we welcome this means to 
our end. With the support of this office, other privacy commissioners 
and advocates and, above all, its own appointed Information Highway 
Advisory Council, the government committed itself to bringing in 
what then-Justice Minister Allan Rock described as “effective and 
enforceable” privacy laws 1n the private sector by the year 2000. 


Industry Canada and the Department of Justice issued a discussion 
paper, The Protection of Personal Information — Building Canada’s 
Information Economy and Society, and called for public input. The depart- 
ments are now digesting the responses (including ours — see page 11) 
and distilling their findings into a draft bill, aiming at publication in 
October, 1998 


It is no exaggeration to call this the most important and promising 
Canadian development in privacy protection since the government’s 
1971 report Privacy and Computers (which set the stage for the first pri- 
vacy protection law in Part IV of the Canadian Human Rights Act). A 
good bill, living up to Mr. Rock’s “effective and enforceable” objective, 
will place Canada among the world’s leaders in defence of basic privacy 
rights. A bad one, studded with exceptions, exemptions and loopholes 


— and absent effective independent oversight — would be a disaster. 


This office thus lives in high 1f somewhat nervous hopes. We observe 
powerful lobbies being organized by some elements of the private sec- 
tor. And we have healthy if grudging respect for their ability to obtain 
favourable treatment for their special interests. 


Another hurdle for this gestating legislation 1s the belief in some quar- 
ters that nothing effective can be done unless federal and provincial 
governments act together. It is true that much business falls under 
provincial jurisdiction. And it is evident that a harmonized approach 
and laws are extremely desirable. Consistent national standards would 


make life easier for both business and government, understandable for 
individuals and avoid the spectre of data havens within the federation. 
This is the ideal. Nevertheless, if others cannot be convinced to protect 
their citizens’ privacy rights in the marketplace, then the federal gov- 
ernment must lead by example; a role the federal government seems 
poised to fill. The spotlight now shifts to the provinces which have 
jurisdiction over much of the private sector. 


A Medical Internet? 


Our other major preoccupation is the fate awaiting the management of 
Canadians’ medical files. It is difficult to imagine any issue that conveys 
as much potential danger to privacy and confidentiality as the current 
efforts to create a national health information system. The system 
promises to make available the health information of virtually the 
entire population on-line for armies of health professionals, bureaucrats 
and researchers. A leak from a doctor's office is damaging enough; | 
maintaining a trusted relationship with the health system’s cast of thou- 
sands in quite another. 


Work on this project continues apace, animated by a special federally- 
appointed advisory council whose membership includes no privacy 
specialists. Surprisingly little public attention has attached to this pro- 
ject considering how it will touch the lives of all of us. 


The forces driving this project are several. They include the health 
bureaucracy at all levels — federal, provincial/territorial and municipal 
— which anticipates substantial cost savings, better anti-fraud controls, 
more efficient delivery of services. But they are not alone: health 
researchers argue that a more complete profile of the state of 
Canadians’ health will lead to greater progress in all fields of medicine, 
particularly preventive. 


Canadian doctors, however, while conceding some potential benefits, 
are extremely concerned. They fear the possible erosion, if not destruc- 
tion, of the basic ethic of their profession: absolute confidentiality of 
the patient-doctor relationship. On that account, the Canadian Medical 
Association has devised a comprehensive privacy code which posits as 
its basic principle the need to obtain patient consent for almost every 
form of informational exchange. The draft is thoughtful and thorough. 


Should it stand it will be nothing less than a Hippocratic Oath for the 
information age 


This is a critical step at a crucial point in the evolution of health infor- 
mation management. It obliges proponents of a national health system 
to bring forward a proposal which meets decent privacy standards or 
risk the united opposition of the medical community. 


It must be said that the advisory council is well aware of the privacy 
issue. The Co-chairman, Dr. Tom Noseworthy of Calgary, has publicly 
committed himself to a high level of privacy protection and, naturally, 

he enjoys the whole-hearted support of this and similar offices in its 
pursuit. But it would be naive and unrealistic to underrate the difficul- 
ties and complexities implicit in creating such an intricate web of 

health information exchanges in a way that protects the right of indi- 
viduals. It bears repeating: the corollary of a publicly funded health care - 
system 1s not abdication of that bedrock principle of our right to a 
confidential relationship with our doctors. 


We therefore offer this advice: Use the privacy expertise already avail- 
able to the maximum. Get it right the first time and public (and 
privacy commissioners’) support will follow. Fail, and eroding public 
confidence will take the system down with it. 


We follow the progress of this work with anxious care, firm in our 
conviction that if it cannot be done without the wholesale abolition of 
existing rights, it ought not to be done at all. 


A sidebar to the CMA’s promising code, and an early indication that 
health information codes are both desirable and do-able with mem- 
bers’ commitment, is the new privacy component of the Canadian 
Dental Association’s Code of Ethics. The Code (which is enforceable in 
some provinces) establishes dental patients right to seek dental care in 
‘a confidential setting free of third-party intrusion”. Patients have the 
right to examine and copy their records, control disclosure, and know 
with whom the information may be shared (with their consent). Third 
parties (such as Revenue Canada or insurance companies) may only 
access patient records for audits after identifiers and unrelated health 
information have been removed. This laudable effort underscores the 
CDA’s ongoing commitment to its patients’ interests. Members will not 
be sorry. 


Updating the Privacy Act: another Year 2000 challenge 


Perhaps lost in the shadow of these grand projects 1s the now-pressing 
need to modernize the existing Privacy Act.The act controls only the 
information handling of many — but not all — federal government 
agencies. It was a good bill in its time; major aspects of it have stood 
well the test of the last 15 years. However, the changing nature of pri- 
vacy threats has also exposed some flaws and weaknesses. 


The primary one of which is the law’s focus on protecting informa- 
tion. It is not truly a privacy law but a data protection statute. In fact 
privacy has surprisingly little protection in Canadian law; torts in some 
provinces-andi---~-as-alast resort —— the, hater (seepage Fiat 16 
needs a road map to comprehensive privacy protection, the govern- 
ment need look no further than last year’s report, Privacy: Where Do We 
Draw the Line, issued by the Commons Committee on Human Rights. 


But to focus on the current act: first we need to clarify the definition 
of “personal information” to bring it up to speed with new technology. 
For example, DNA samples — tissue, blood, semen — should be 
defined as personal information for the purposes of the Act. And the 
Act needs more precision in its definition of what information about 
public servants “relates to the position or functions of the individual”. 
A clear definition might have avoided costly Court cases like those 
dealing with access to weekend sign-in sheets and parking privileges. 


The Act’s provisions establishing a person’s right to access his or her 
personal records, and to require consent before disclosing personal 
information, are hedged round with numerous exemptions and excep- 
tions which beg review. Most exemptions are justified. For example, it 
makes no sense to allow a person under investigation for a criminal 
offence to be allowed access to investigative records. Nor would one 
allow suspected terrorists to examine their records in CSIS files. But 
some exemptions are altogether too all-inclusive. 


Section 22(1)(a) of the Act, for instance, authorizes federal investigative 
bodies to refuse to disclose information “pertaining to the enforcement 
of any law of Canada or a province”. This is sufficiently sweeping as to 
permit nine investigative bodies to refuse to release virtually all person- 
al information. 


I find particularly offensive the notion that departments can withhold 
information from applicants simply because the law allows it, even 
though disclosure would cause no demonstrable injury. All exemptions 
should be subject to an injury test, meaning investigative bodies should 
be required to demonstrate how granting access to an individual would 
harm a law or their investigations. 


Next, given the fundamental importance of Sections 4 to 8 (the fair 
information code), Parliament should expand individuals’ rights to 
appeal to the Courts about government collection, use and disclosure 
of personal data. This could include injunctive rights, or a privacy tort 
allowing individuals to sue for damages. 


Also needed is a much tighter concept of the notion of “control” of 
personal records. This would prevent government institutions from cir- 
cumventing the act by contracting out such products and services as 
investigations and surveys, or distancing themselves from personal 
records such as board members’ notes. 


Another serious weakness 1n the Act lies in information-sharing agree- 
ments and arrangements between the federal government and other 
levels of government (including governments of other nations), and the 
private sector. Many of these agreements are essential for the conduct 
of government operations, and are authorized by many statutes, includ- 
ing the Privacy Act. However, the scope of sharing permitted by the 
Act’s broad language is an open barn door for even the slowest horse. 
There are hundreds of such agreements in existence, of which this 
office has only fragmentary knowledge. But what we do know is not 
comforting. Much of the sharing 1s virtually invisible to taxpayers, and 
often to the departments themselves. 


Also, given the routine and detailed exchanges underway, it is essential 
that federal departments be required to ensure that any personal infor- 
mation they disclose enjoys proper privacy protection in the hands of 
the recipients. At a minimum, the Act should require departments to 
obtain a contractual commitment to provide privacy protection equiva- 
lent to that offered by the federal Privacy Act, coupled with a right to 
take those measures necessary to ensure that the commitments are 
honoured. Similar legal requirements should be placed on any private 
enterprise taking over any program or activity previously conducted by 
the government of Canada. 


The government has responded in part. The Treasury Board has direct- 
ed departments to include in privatization agreements some protection 
for the personal information being transferred. New bodies which 
remain in federal jurisdiction will be subject to the Privacy Act. 
Organizations that are privatized and come under provincial jurisidic- 
tion will have privacy clauses written into the sale contract. 


Time for some housekeeping 


There is also an urgent need to review the powers and mandate of the 
Office. In the beginning, the Office functioned principally as a com- 
plaint investigation bureau. That remains its primary statutory duty — 
and the only one for which it is funded. But the intervening years have 
imposed many new demands on the office not contemplated by the 
Privacy Act. One of these 1s the capacity for policy analysis and research 
so essential to keeping Parliament and the public abreast of important 
privacy developments: this was the term of Internet, digital fingerprint- 
ing, datamining and the National Health Information Infrastructure. 
This Office would be irrelevant to both legislators and taxpayers with- 
out such a service, one we struggle to provide now without any 
resources or legal mandate. 


Even our core investigation function is under serious strain. During 
this seven year term, the size of the office remained virtually static, 
despite a complaint load now more than twice as large as at the outset. 


Similarly, there is a growing public appetite for more information 
about the impact of technology on society. While Parliament may not 
have anticipated the public turning to us for answers, no-one told the 
public — witness the explosion of inquiries in the period. This Office 
has no mandate for public education, and thus no funding. 
Nevertheless, we strive to meet these demands, conscious only that our 
best efforts are a marginal response at best. 


These problems were examined and solutions proposed in a review 

of the Act by the Commons Justice Committee in 1987, then again in 
the special report Privacy: Where do We Draw the Line. No action so far, 
although the Justice Department, which is responsible for privacy law, has 
been considering amendments during the last two years. One can only 
wish that these particular judicial mills did not grind quite so slowly. 


This review concludes with a footnote; a seven-year itch which the 
Commissioner would now like to scratch. Repeatedly during this 
period proposals have bubbled up to “merge” the Offices of the 
Information and Privacy Commissioners. Although the idea has been 
repeatedly stoked and fed by others, I have held my public peace, 
thinking it better to mind my own business and hoping that others 
would mind theirs. 


It is time now to put this issue to bed. Privacy and access to informa- 
tion laws are not flip sides of the same coin. They have this in 
common: both provide Canadians right of access to records held by the 
federal government. But there the similarity ends. Access by definition 
is the limit of the Access to Information Act — does the applicant get the 
records or not? And, if the records at issue are personal, they are gov- 
erned by the Privacy Act. 


Otherwise, the two acts have about as much in common as soccer and 
succotash. Access to general government records is an administrative 
right, recently taking root in modern democracies, which sets out 
terms under which citizens can see government files. But many 
democracies do not have such laws. Privacy, however, 1s a core value, a 
basic human right which touches almost every aspect of life. It 1s, as the 
Supreme Court of Canada has said, a basic element in establishing indi- 
vidual freedom. Such is the freedom this office works to preserve. 
Indeed, all modern democracies protect the value in law and appoint 
an arbitrator/overseer. Only in Canada — and only in the provinces — 
does that arbitrator wear both the privacy and information hats. 


The coming of private sector legislation and the Office’s possible role 
in its oversight makes the time ripe for a clean amicable divorce. 
Business needs to know that the regulator has but one priority and that 
is its handling of the personal information of its clients and employees. 
There can be no suspicion that a single commissioner might have an 
interest in general records. 


Finally Parliament needs to fix an unforeseen weakness in the structure, 
reporting mechanism and accountability of the Office which have a 
debilitating effect. 


The Privacy Commissioner’s office is an orphan. Despite his status as a 
Parliamentary officer, Parliament makes only occasional and cursory 


examination of the issues and our operations. The budget is set as part 
of the Department of Justice envelope. Thus my only avenue of bud- 
getary appeal 1s to ask the Minister of Justice (whose operations I may 
have to investigate) to beggar her own program. This arrangement 
sends all the wrong messages about the Office’s independence and 
makes the principals profoundly uncomfortable. It is time the Act 
established a clear line of responsibility and accountability to 
Parliament, and it may also be the moment for Parliament to consider a 
consistent reporting and funding regime for all its officers. 


Finally, allow me to give public expression of profound gratitude to an 
exceptional staff of devoted colleagues. Whatever credit accrues to this 
Office, or to me personally, is due to their high sense of purpose and 
professionalism. No commissioner was ever better served by or more 


deeply indebted to his staff. 
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A Private Sector Privacy Law 


Comprehensive legislation to protect personal information in Canada’s 
private sector has been both long needed and much anticipated. 
However, until very recently, private sector legislation appeared des- 
tined to be the perennial bridesmaid of the legislative process, always 
hovering near the altar, but never quite getting there. Now there is 
renewed hope, largely due to two initiatives. 


The first is the government’s discussion paper, entitled The Protection of 
Personal Information: Building Canada’s Information Economy and Society 
which was released in January 1998. The paper sought public comment 
on a proposed model for legislation to protect personal information in 
the federally-regulated private sector. The second 1s a draft Private 
Sector Protection of Personal Information Act now being prepared by 
the Uniform Law Conference of Canada which could serve as the 
basis for consistent private sector law across Canada. 


The history of attempts to bring private sector data protection legisla- 
tion to Canadians dates from the early 1980s. When the bill that | 
became the federal Privacy Act was introduced for third reading in June 
1982, the then-Minister of Communications observed that “the next 
stage in the development of privacy legislation, [is] extension of the 
principles respecting the protection of personal information to the fed- 
erally-regulated private sector.” Since then, protection of personal 
information in the private sector has raised its head several times: 


¢ In March 1987, the Standing Committee on Justice and Solicitor 
General endorsed private sector legislation in its report, Open and 
Shut: Enhancing the Right to Know and the Right to Privacy. 


In May 1996, the federal Industry Minister announced that consulta- 
tions with the provinces and other “stakeholders” would be 
undertaken to bring forward proposals for a “legislative framework 
governing the protection of personal data in the private sector.” 


¢ In September 1996, then-Justice Minister and Attorney General Allan 
Rock announced that “by the year 2000, we aim to have federal leg- 
islation on the books that will provide effective, enforceable 
protection of privacy rights 1n the private sector.” 


¢ In April 1997, the House of Commons unanimously endorsed a pri- 
vate member’s motion by Mr. Paul Crete to extend the existing 
Privacy Act to cover all Crown corporations. 


¢ In April 1997, the Standing Committee on Human Rights and the 
Status of Persons with Disabilities produced a report entitled Privacy: 
Where Do We Draw The Line?; the report recommended that the cur- 
rent Privacy Act be replaced with a Data Protection Act that would 
extend privacy protection to personal information held by 
Parliament, all federal government departments, agencies, Crown cor- 
porations, boards, commissions and other institutions, as well as all 
federally-regulated businesses and industries. 


° In March 1998, the Uniform Law Conference of Canada, an inde- 
pendent and non-governmental body, released its most recent draft of 
a uniform Private Sector Protection of Personal Information Act. 


The government’s proposal: a good start 


Given the national nature of the private sector privacy issue, the 
responsibility naturally falls on the federal government to exercise lead- 
ership. Fortunately, major sectors of commerce such as banks, 
communications and transportation, fall squarely within the federal 
government’s jurisdiction — three sectors which are among the most 
important collectors and users of personal information. Now, more 
than fifteen years after first publicly raising the prospect of protecting 
personal information in the federally-regulated private sector, the fed- 
eral government is preparing to draft legislation. 


The joint Industry Canada/Department of Justice discussion paper 
describes the present state of privacy law in Canada and why it is 
insufficient to protect Canadians in the current environment. It estab- 
lishes the basic principles of effective privacy legislation, then discusses 
some options for implementing such a law and providing independent 
oversight. However, the paper’s thrust is less about protecting personal 
information than it is an encouragement to feel confident in engaging 
in electronic commerce. It is revealing that the paper’s introductory 
quotation, from the September 1997 Speech from the Throne, makes 
no reference to privacy or data protection. 
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Legislation to govern the federally-regulated private sector is important 
for several reasons. The distinction between the private and public sec- 
tors is blurring. Increasingly the federal government, like many others, 
is privatizing, commercializing and contracting out government func- 
tions. In some instances this had moved personal data outside the scope 
of federal privacy law. In addition, technology has raised the stakes, 
intervening in the relationship among Canadians, the private sector and 
government and permitting an unprecedented collection, use and dis- 
closure of personal information. | 


Providing legal protection for personal information in the federally- 
regulated private sector is a goal that can be accomplished now. The 
ideal solution, of course, would be to have consistent privacy and data 
protection laws in the provinces and territories. Quebec already has put 
such legislation in place — the only North American jurisdiction to 
have done so. 


A level playing field The discussion paper advocates harmonizing 
privacy and data protection laws in all Canadian jurisdictions. This 1s 
essential if the rules are to be consistent across the country and if we > 
are to avoid building data havens — jurisdictions where less stringent 
laws could attract some businesses seeking to avoid their privacy oblig- 
ations. Private sector legislation in the provinces should be modeled on 
the best features of federal private sector legislation, Quebec’s private 
sector law, the Uniform Law Conference of Canada draft Private Sector 
Protection of Personal Information Act, and the Canadian Standards 
Association’s Model Privacy Code. 


Protection of personal information might also be considered a federal 
matter under the trade and commerce heading in the Constitution; this 
interpretation of the Constitution would enable the federal govern- 
ment to legislate uniform data protection across the entire private 
sector. 


On the CSA Model The discussion paper highlights the work of the 
Canadian Standards Association (CSA) in bringing together representa- 
tives of the public sector, business, consumers and unions to draft a 
model code. The code establishes principles for private sector collec- 
tion, use, disclosure and protection of personal data, as well as ensuring 
individual access to, and correction of, the information when necessary. 
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The Standards Council of Canada adopted the CSA code as a national 
standard in 1996. 


Given the necessary teeth, the broad principles of the CSA Code pro- 
vide a solid foundation for building privacy legislation. And the CSA 
‘Code has the added benefit of having won the endorsement of several 
provincial privacy commissioners. However, there remain a number of 
deficiencies that would result in a legislated data protection standard 
that is not sufficiently rigorous and would offer only the illusion of 
effective protection for personal information. For example, it is insuffi- 
cient simply to identify the purposes for which personal information 1s 
collected. Individuals should also be told whether providing the infor- 
mation is obligatory or optional, the consequences of failing to provide 
the information, who will recetve it and how they will use it. 


Designing a new privacy law begs several questions about its adminis- 

tration and oversight. If it is to work, the law cannot be burdensome 

and bureaucratic for business. Nor can it impose on consumers an 

accountability process by exhaustion. The paper discusses several 
options. 


Sectoral Codes & Registration While some countries require or 
encourage industry sectors to draw up more specific codes tailored to 
the demands of their industry and clients, we do not support codes as 
part of Canada’s regulatory scheme. 


While undoubtedly helpful to guide individual businesses, sectoral 
codes would be impractical. For a start, defining sectors would be difti- 
cult as industries continue to converge and re-align. It would also be 
difficult to ensure that the codes of each individual business were con- 
sistent with the sectoral standard. Finally, sectoral codes may be 
unnecessary. Quebec’s private sector data protection law makes no use 
of sectoral codes and yet has not suffered since it came into force in 


January 1994. 


Another feature of some national laws is the requirement that private 
businesses register their personal databases with a central authority. 
Registration would be unnecessarily costly and bureaucratic. It may 
also be a misapplication of resources that could better be used else- 
where to protect privacy interests. 
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Oversight Whatever the features of the law, it will need independent 
oversight; a body to review compliance and resolve disputes. The 
options range from requiring complainants to go to court — costly 
and burdensome for all parties (including the courts), to quasi-judicial 
tribunals, to data commissioners with order-making powers. 


The ombudsman model, the scheme in place under the federal Privacy 
Act, offers the most effective approach. An ombudsman ensures admin- 
istrative fairness using knowledge, impartiality and strong investigative 
powers. The essence of successful oversight is maximum reliance on 
consultation, conciliation and negotiation, and minimum resort to 
coercion and compulsion. The ombudsman’s stick is the possibility of 
bad publicity — an effective tool if judiciously applied. 


The Privacy Commiussioner’s oversight would entail promoting fair 
information practices, resolving complaints, and conducting audits. The 
Commissioner should also have the specific authority to identify and 
assess issues that may affect privacy — for example, workplace surveil- 
lance, personal identification technologies and the tracking of purchase 
information, even if these issues have not caused complaints. Given _ 
adequate infrastructure and resources, this office would be an effective 
oversight agency. 


Extending the Privacy Commissioner’s jurisdiction to the federally- 
regulated private sector would also be consistent with the scope of 
other federal oversight bodies such as the Office of the Commissioner 
of Official Languages. 


Some business sectors suggested that oversight might be acceptable if 
conducted by existing regulators — such as the Superintendent of 
Financial Institutions for banks. However, this would lead to multiple 
regulators, without data protection experience, and inevitably result in 
uneven application, and thus uneven compliance with privacy stan- 


dards. 


Public Education No legislation will be effective without its being 
understood by public and business. Organizations and their respective 
associations should bear the primary responsibility for educating 
employees, management and the public. Informed consumers and 
employees are more likely to encourage organizations to adopt fair 
information practices. However, the proposed legislation should also 
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give the Commissioner a specific mandate and resources to increase 
public awareness about issues and new technologies that could affect 
privacy. 


Complaints Process The complaints process must be administrative- 
ly simple for both the complainant and the business which holds the 
personal information. Individuals should begin by trying to resolve 
their complaints directly with the organization. Since disputes often 
result from misunderstandings, many can be resolved at this stage. 
However, the organization should be free to refer the complaint direct- 
ly to the Commissioner if it would prefer to have the complaint 
handled through the Commissioner’s complaint resolution process. 
Time limits should be set for each stage in the resolution process to 
avoid unwarranted delays. 


The Commissioner would make recommendations, as necessary, about 
the collection, retention, use or disclosure of personal information, as 
well as about any denial of access or correction. The Commissioner 
should further have the right to identify any appropriate redress for the 
complainant. The Office should be vested with powers to investigate 
_and resolve complaints, such as those currently available under the fed- 
eral Privacy Act. 


The law should oblige the parties to participate in mediation facilitated 
by the Office. The Commissioner would then issue a non-binding 
evaluation of the parties’ respective positions. 


Compliance Audits The legislation should require organizations to 
undergo periodic information practices audits. The organization would 
be free to appoint the auditor of its choice and would be expected to 
take corrective action within a reasonable time after receiving the audit 
recommendations. In addition, legislation should authorize the 
Commissioner to conduct an issue-based audit of one or several orga- 
nizations if the Commissioner has reasonable cause to suspect that their 
information handling practices are inadequate, or if the Commissioner 
receives multiple complaints about similar deficiencies. 
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Privacy Impact Assessments The Commissioner should provide 
organizations with the tools necessary to conduct privacy impact 
assessments on any activity that may affect privacy. This will help orga- 
nizations avoid costly redesigns that may be necessary if fair 
information practices are not considered at the design phase of their 
activities. In addition, the Commissioner should have the authority to 
monitor disclosures for research and statistical purposes. 
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Protecting Health Information — 
Privacy under the weather 


Last year’s annual report spelled out the privacy implications of one 
aspect of the government’s proposed national health strategy — a 
national health data network. We seem to have touched a nerve. 


The loudest voices supporting the network are those seeking access to 
confidential medical records — for more efficient spending of limited 
health care dollars, improved flow of information between jurisdictions, 
and better evidence of what influences Canadians’ health. All are wor- 
thy aims. However, making patient information available on-line (and 
integrating it with socio-economic data to create patient profiles) risks 
turning patient care into a “spectator sport”. 


There are hopeful signs that others are listening. First, February’s 
National Conference on Health Info-Structure brought together gov- 
ernment representatives, health professionals, academics, consumers and 
business to develop action plans for establishing the info-structure. At 
the head of the list of policy issues discussed were “Privacy, security 
and confidentiality”. 


In his opening remarks, Health Minister Allan Rock cited privacy as 
“perhaps the crucial issue. The credibility of a national strategy hinges 
on public confidence that privacy will be protected.” He acknowledged 
that many in the health sector were concerned that “stringent privacy 
rules could impose unreasonable limits on the information they need”, 
nevertheless he announced himself determined to see that Canadians 
“get the right protection for their most personal information”. 


In the working session, other voices joined 1n to protest that effective 
and meaningful health care does not have to be compromised to pro- 
tect patient privacy. However, network supporters argued that good 
security 1s the answer to real privacy protection. They urged that we 
build the systems first, then “fix” the privacy issue afterwards. 


(At press time, there has been no public report of the conference pro- 
ceedings or of any subsequent action plans.) 
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Developers of this network need reminding that using a patient’s med- 
ical information without his or her knowledge and consent is an 
invasion of privacy, regardless of the system’s security. That is the dis- 
tinction between ensuring security and preserving privacy that must be 
maintained at all costs. 


Medical information — and the circumstances under which much of it 
is provided — are unique. We are a captive audience when we are sick 
or hurt. At that vulnerable moment when we want our health restored, 
we feel compelled to provide intimate details of our lives we would 
otherwise choose to keep private. Health care providers need any and 
all personal information that might be helpful during a crisis. But this 
intimate information, once revealed, may become part of a “womb-to- 
tomb” electronic medical record. 


At that point, the patient (and, arguably, the doctor) will have lost con- 
trol. The details could become accessible far beyond the physician with 
whom the patient has established a trust relationship. Information 
could be shared with the broader health care system and perhaps also a 
present or future employer, an insurance company and the credit 
bureau. Information we volunteered for medical treatment could be 
used for unrelated purposes, with devastating effect. 


There seems to be a view that a public health system justifies greater 
intrusions. As the links between life style, poverty and health become 
clearer, so grow the temptations to follow, assess, and then influence 
our choices so that we will not become a burden on the system. While 
understandable, this is the first step to a loss of autonomy. Making edu- 
cated health decisions is one thing — being coerced quite another. 


Canadian Medical Association Draft Code 


Another encouraging sign is the Canadian Medical Association’s draft 
Health Information Privacy Code, now being developed. The June 16 
draft code meets the measures we set out in last year’s report — and 
more. The added feature? While the CMA Code follows the general 
structure of the Canadian Standards Association Model Privacy Code, 
its content was inspired by the Parliamentary Committee's report, 
Privacy: Where Do We Draw The Line, which recognized privacy as a 
human right and social value. 


19 


In a background paper, the CMA recognizes that “initiatives advertised 
under the rubric of ‘protection of privacy’ often have less to do with 
privacy protection than with ensuring access for secondary use” and 
that “...[i]f ‘authorization’ is not 1n the hands of patients, then it is 
‘doublespeak’ to say that ensuring access only as ‘authorized’ protects 
the right of privacy.” 


The incentive for the CMA to promote privacy 1s obvious: ensuring 
the integrity of the doctor-patient relationship. Physicians swear in the 
Hippocratic Oath “what I may see or hear in the course of the treat- 
ment or even outside of the treatment in regard to the life of men, 
which on no account one must spread abroad, I will keep to myself 
holding such things shameful to be spoken about.” As the CMA paper 
observes “... [p]hysicians, in light of patients’ high level of trust and 
confidence in them, could therefore become unwitting instruments of 
betrayal. Behind physicians would stand any number of secondary users 
who are strangers to the patient-physician relationship but eager to 


share in information secured by physicians.” 


As we go to press, the Code 1s expected to be presented to the CMA’s 
~ General Council for debate this September. 
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Investigations Branch 


The record-setting complaint intake continues apace — 2,455, com- 
pared with 2,235 received last year. This increase is in keeping with the 
average growth of 10 per cent annually over the past ten years. 


Staff completed 1,821 investigations, close to 900 fewer than last year. 
Last year’s accomplishment was directly attributable to the Office’s 
efforts to reduce a backlog of older complaints by streamlining the 
process, introducing a fast-track procedure for selected complaints, and 
using resources drawn temporarily from other parts of the organiza- 
tion. Those resources were not available this year. 


For the past several years, the Office has first tinkered —— then substan- 
tially revamped — its investigation process to eliminate bottlenecks and 
speed the process. However, more than tinkering 1s needed; as quickly 
as new approaches are tried, our clientele becomes more sophisticated 
and their complaints more complex. As the intake of new cases contin- 
ues to grow, investigators are confronted with caseloads that are 
excessive, time consuming and unmanageable. The result for com- 
plainants is resolution delayed and, for investigators, burnout. 


Coupled with this unmanageable caseload, increasingly investigators 
must deal with departmental privacy staff who are also overloaded and 
often impatient and uncooperative. Frustrated with repeated requests 
from some applicants who use the Privacy Act as a tool to conduct per- 
sonal vendettas against selected departments, staff effectively stall 
investigators by rescheduling or delaying meetings, delaying identifying 
departmental contacts, or failing to produce the records for the investi- 
gators review. 


The Office is not unsympathetic to the departments’ plight; some 
applicants do indeed make repeated requests that border on abuse of 
the system. They also make repeated complaints. However, the law 
makes no provision for either departments or the Commissioner to 
ignore or stall repeated requests or “trivial and vexatious” complaints. 
Nor does the Commissioner believe it should. The act obliges us to do 
our respective jobs; departments to respond in a timely manner and this 
Office to investigate any subsequent complaints. 
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The Commissioner cannot and will not tolerate departments stalling 
his investigators. 


The open caseload at the end of the reporting year — 1780 — has also 
climbed from the 1147 open at the end of the previous year. One issue 
contributes 956 of these complaints; government’s matching of 
Customs Traveller Declaration Cards with the Employment Insurance 
data base. This match is now before the Court (see page 89 for more 


detail). 


Lingering investigations also contribute to some complainants’ disap- 
pointment when the Commissioner concludes there has been no 
breach of the act. It is little consolation to someone who has waited 
months for the Commissioner’s review only to be told that the depart- 
ment’s actions did not offend their privacy rights. Some conclude that 
we have been of little help. In fact, the Office’s rate of well-founded 
complaints, 48 per cent, is high compared with the traditional one- 
third ombudsmen’s average. 


The cases described below illustrate the type of concerns Canadians 
_ bring to the Commissioner. 


Hosts tax documents not “required” for visitors visas 


A journalist’s question about Citizenship & Immigration demanding 
tax information from Canadian hosts before issuing a visa to their visi- 
tors, prompted an Ottawa couple to complain. The husband’s sister was 
planning a business trip to the United States and wanted to spend a 
week with him in Canada. 


When she applied for her visa to the Canadian High Commission in 
Colombo, Sri Lanka, they refused to process her application without 
an income tax document confirming the income of both the host 
and spouse for the last three years The tax documents were 
“REQUIRED” (their emphasis). She was also asked who would 

pay for her trip to Canada. 


The couple had provided proof of Canadian citizenship and their 
employment but objected to producing the income tax documents. 
According to C&l, before issuing visitors’ visas, it wants to be sure that 
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the visitor will return home and not become a burden on Canadian 
society. The documents were meant to establish that the hosts could 
afford to support the visitor. 


Apparently each high commission decides which documents visa appli- 
cants need, depending on local circumstances. The Columbo high 
commission began demanding a Revenue Canada Notice of 
Assessment in March 1997 to assess the financial situation of the hosts. 
They argued that bank statements and letters of employment are sub- 
ject to abuse and inaccuracies, and are hard to verify. As well, affidavits 
simply cannot be enforced. The Notice of Assessment contains the tax- 
payer’s amount of income and taxes paid and, since it 1s official, needs 
no further verification. 


However, it was clear that tax documents were not essential to process- 
ing a visa application — although they could speed the process. High 
commission officials acknowledged that providing tax information is 
“voluntary” and have now emphasized this for all staff. At the Office’s 
request, they have also amended the application form to remove the 
statement that the information 1s required. 


The investigator asked C&I to determine what other embassies and 
high commissions ask on their visa applications. Of the 61 responses 
received, five showed tax information as “REQUIRED”. C&I agreed 
to contact each of the five and have them amend their forms. 


It is questionable whether knowing someone’s gross income helps 
assess his or her “financial situation”; some families live very comfort- 
ably on $60,000 while others struggle with $100,000. The complaint 


was well-founded and resolved. 


Employee accesses woman’s credit file 


The notion that federal government departments have access to indi- 
vidual credit files is puzzling to many. The explanation is simple: many 
government positions have security requirements, ranging from the 
least demanding “enhanced reliability” up to various levels of Special 
Access reserved for highly sensitive intelligence work. 
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Employers check employees’ credit references to ensure their finances 
are not in such a precarious state that they may be susceptible to finan- 
cial “inducements” or blackmail. To prevent abuse, only a handful of 
departmental staff may have access to credit files — usually staff in the 
security units which are responsible for security clearances. 


This restricted access sent alarm bells ringing when a woman com- 
plained that someone at a department where she neither worked or 
sought a job, had accessed her file at the local Ottawa credit bureau. 
Attached to her letter was a copy of her credit report listing those 
organizations which had obtained access. It included a departmental 
telephone number and the identification “Security Serv”. The woman 
was going through a divorce and feared that her estranged husband, 
who worked in the department’s Security Services, had queried her 
credit file. 


Although the investigator confirmed at both the credit bureau and 
Security Services that the woman’s file had been accessed, it was 
impossible to determine by whom. The department’s credit checks are 
conducted by three employees, usually by computer-modem access 
using three telephone numbers. The same credit access password served 
all three computers and it was programmed into the automated query 
process. (Telephone queries require the caller’s name which is recorded 
at the bureau.) During an internal investigation, staff found a hard copy 
of the woman’s credit report in her husband’s office, however it was in 
a different format from routine on-line queries. 


The husband categorically denied having accessed his wife's file, argu- 
ing that he did not know how to conduct an on-line check and he 
believed he was at a regular Friday staff lunch when the query was 
made. The investigator’s interviews with unit staff established that the 
husband’s computer was not one of the three with access to credit files, 
that no-one had seen him at one of the terminals, nor had he asked 
them to conduct the check. However, the instructions for making an 
on-line query were readily available in employee in-baskets. A query to 
the government telephone system (GTIS) to establish precisely on 
which line the call was made came up empty because GTIS logs only 
long-distance not local calls. 
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The experience was a first for the department which has Privacy 
Directives available on every computer. The department responded by 
conducting its own internal investigation and tightening its credit 
access procedures. These include changing the system access code, 
introducing individual passwords for staff so that any future queries will 
identify the caller, and restricting access to the instructions for entering 
the system. It also reassigned the employee. 


The Commissioner concluded that there was no doubt that the 
woman's credit file had been improperly accessed and that the com- 
plaint was well-founded. Although there was no remedy, the more 
stringent security measures should help prevent a recurrence. The 
Commissioner urges other security units to take note. 


(Although the Office routinely identifies departments against which 
complaints are made, doing so in this case would effectively identify — 
the individuals concerned, breaching the Commiussioner’s legal obliga- 
tion to investigate in private.) 


Commissioner’s complaint tightens HRDC collection process 


A provincial government manager alerted the Office to a Human 
Resources Development Canada (HRDC) collection which disturbed 
him. He had received more than a dozen requests from HRDC 
collection officers for information about former employees of his 
department and questioned their method of seeking the information, 
the amount of detail, and his obligation to respond. 


Subsequently two federal government departments — Health Canada 
and National Archives — were faced with similar requests and also 
called the Office with concerns. Given the investigator’s findings, these 
two were likely the tip of an iceberg. With sufficient information in 
hand, the Commissioner initiated his own complaint. 


HRDC collection officers attempt to collect established overpayments 
of (un)Employment Insurance (EI). Approximately 80 per cent of the 
cases constitute fraud and some involve substantial sums of money. The 
EI legislation allows HRDC up to six years to recover the overpay- 
ment. 
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Although HRDC’s demands for information varied from one city to 
another, most asked for the person’s term of employment, reason for 
leaving, home address and telephone number, bank address, and name 
and address of current employer if known. HRDC officials in 
Winnipeg and Moncton also asked for the name and address of the 
person the former employee designated be called in cases of emer- 


gency. 


The provincial manager had also received a request for detailed infor- 
mation about an individual’s bank accounts and balances, RRSPs, 
GICs, term deposits, accounts at other branches and any company 
accounts. It was clear that this was an error since an employer would 
be unlikely to have such information. The request was intended for the 
employee’s financial institution, not the employer. 


The investigator sifted through all the information and allegations and 
focussed on six aspects of the case. An allegation that the requests were 
being faxed was found not to be true. 


Had HRDC followed the proper procedure for collecting the 
information? The EI Act requires collection officers to request the 

_ information from any person “by notice served personally or by con- 
firmed delivery service”. This provides proof that any individual, 
employer or financial institution received the notice. It was evident that 
HRDC was not following the procedure because it was more expen- 
sive and more onerous than regular mail. 


Could HRDC ask for names and addresses of emergency con- 
tacts? In effect, HRDC was seeking information about “unnamed 
persons’ — information supplied for a specific and limited purpose 
about individuals who are not a party to the case. The EI Act stipulates 
that HRDC cannot require any third party to provide information 
about “unnamed persons” without.a judge’s authorization. This had not 
been obtained. 


Can HRDC collect detailed financial information on clients 
from financial institutions? The broad authority to collect informa- 
tion from “any person” 1s clearly established in the EI Act. Having the 
financial details allows HRDC to seize financial assets once they 
mature — usually a last resort. Knowing account balances and other 
short term assets allows HRDC to calculate a repayment schedule or 
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the amount which could be garnished from the clients’ pay (once they 
are located) without causing undue hardship. Apparently some financial 
institutions, which once routinely provided the information in response 
to mailed requests, have now begun questioning HRDC’s requests for 
financial information. 


Had collection staff cited the correct legal authority? Some let- 
ters (incorrectly) cited subsection 126(15) of the EI Act. This section 
deals with those unnamed persons and requires the judge’s authoriza- 
tion. The correct citation is 126(14). 


Were requests to federal departments flagged “‘protected’’? 
Personal information in the hands of federal government departments 
must be labelled “protected” to help guard against unauthorized open- 
ing or access to personal data. The requests to Health Canada and 
National Archives were not properly flagged. 


Why collect the reason for departure? If the employee worked 
for the government, HRDC can collect the debt by offsetting the 
amount against any severance, unused leave or pension payments. 


Do collection officers have the authority to demand the infor- 
mation? The Employment Insurance Commission has the power to 
authorize “any person or body, or member of a class of persons or bod- 
ies” to exercise its powers. A list of those exercising delegated powers 
includes “Collection Officer, Overpayment Recovery”. Clearly these 
staff have the authority to demand the information. 


HRDC dealt with three of the four problems in a December 1997 
memo from the chief of collection services. He reminded staff to deliv- 
er the letters personally or by confirmed delivery service; not to ask for 
the client’s emergency contact without a judge’s authorization, and to 
use the correct legal citation. HRDC staff are also reviewing the letters 
to attempt to standardize the language as much as possible, thus avoid- 
ing a repeat. They will also add a “protected” designation to help 
prevent unnecessary disclosures. 


The Commissioner appreciates the department’s ready cooperation and 
quick response to his recommendations to tighten the process. 


2/ 


Three-hour Family Expenditure Survey voluntary — next time 


Statistics Canada surveys often cause ripples, particularly those dealing 
with individuals’ finances. This year, a StatsCan decision to make one of 
its regular surveys compulsory prompted three complaints to the 
Commissioner and considerable public interest in British Columbia 
(but little elsewhere). 


What distinguishes the Family Expenditure Survey (FAMEX) from 
many others the agency conducts is its length — almost three hours, 
the extent of the detail — 39 long pages, and its venue — the respon- 
dent’s home. FAMEX examines household spending patterns and 
gathers information on their income, assets, debts, occupation and edu- 
cation. 


One complainant described the survey as “grossly intrusive”. He ques- 
tioned whether StatsCan had the authority to compel responses and 
observed that the detail demanded was far beyond the scope required 
for the Consumer Price Index. Two questions cited 1n the ensuing 
publicity were those asking for “...sanitary and incontinence supplies...” 
and “condoms, syringes, etc.”. (In fact, these products — while unfortu- 
nate choices — were simply examples to illustrate the types of 
expenses in the respective categories.) 


The complainant also argued that it was both a “conflict of interest and 
a gross abuse of power to compel by law an individual (to) provide this 
information, then market it for business to use in developing their own 
markets’. 


StatsCan uses some of the information to update the Consumer Price 
Index, a shopping basket of some 600 goods and services it tracks to 
measure inflation. The data can lead to changing the items in the bas- 
ket or altering their relative weight in the total cost. Government can 
also use the data to relate people’s spending patterns to their age, family 
size and income. These factors influence policy on welfare reform, 
wage settlements and support payments. The results also help govern- 
ment compare living costs and standards between various regions, and 
between Canada and other countries. 


However, there is no doubt that the information is sold. In its promo- 
tional material to business, StatsCan extols its ability to tailor the data 
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from FAMEX “to meet your specific needs”. The data is not personal, 
of course, but “can be cross-referenced by household income, metro- 
politan area, age, dwelling owned or rented, household composition, or 
other selected household segments’’. This allows business to target its 
marketing to appropriate groups. 


Responding to all StatsCan surveys is compulsory unless the Minister 
decides otherwise. The Statistics Act imposes penalties on those who 
refuse although StatsCan is loath to be heavy-handed. Regular 
FAMEX surveys began in 1952. Participation became voluntary in 
1984, then reverted to compulsory in 1996 when StatsCan felt that the 
response rate, which had dropped to 74 per cent, was too low. 


The 1996 survey selected 16,000 households across the country in pro- 
portion to population. The already lengthy survey could take even 
longer for those with higher incomes if they have a greater range of 
expenditures and more complex finances. The survey questions are 
divided in broad categories of expenditures on 


¢ housing, equipment, furnishings and services 

¢ groceries, alcoholic beverages and restaurant meals 
¢ clothing 

* personal care products and services 

¢ dental and medical products and services 

¢ vehicles and expenses 

¢ recreational products and expenses 

* personal income and investments 


The level of detail is intense: house furnishings includes such purchases 
as “sheets and pillowcases” and “plastic garbage bags’’; health care 
details include “e.g. first aid kits, bandages, condoms, syringes etc.” 

and “razors and razor blades”; women’s clothing includes “lingerie”; 
recreational expenses seeks “photographic film, processing, extra prints 
and enlargements”; reading materials wants “paperbacks and pam- 
phlets”, the income category asks for the value of gifts received from 
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non-family members. 
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One might well wonder how many Canadians could possibly recall 
these expenditure details a year later, nevertheless the expansive lan- 
suage of the Statistics Act gives StatsCan the power to compel 
responses. The investigator had to quickly disabuse the complainants of 
any notion that the Commissioner could exempt them from respond- 
ing. However, there were aspects of the process which need clarifying, 
primarily concerning its transparency. 


First was the assertion that the survey had to be conducted in the form 
of an interview. This requires respondents to furnish personal details to 
a stranger rather than simply complete a form on their own time. 
StatsCan clearly prefers personal interviews to clarify questions, prompt 
responses and ensure the form is completed. It is also concerned about 
the quality of the data. However, simply completing the questionnaire 
meets both the respondent’s legal requirements and StatsCan’s needs. 
Individuals who feel competent to do so on their own, should be 
offered that option at the outset. 


A second concern was an apparent requirement that the interview take 
place at home. Letters alerting local police, politicians and residential 
property managers to the survey (in case of calls) make it clear that 
interviewers “will visit their (respondent’s) home to conduct the inter- 
view . However, the advance letter to the respondent is less forthright 
— the “interviewer will visit you to enlist your support in this impor- 
tant study”. 


Being subjected to such detailed questions in one’s own home can 
seem very intrusive. Although StatsCan interviewers would be prepared 
to meet respondents elsewhere, it argues that most people would need 
their records to complete the survey and clearly prefers, and “sells”, the 
in-home interview. Nevertheless, respondents are clearly not compelled 
to agree. 


Respondents can take some comfort in knowing that the interviewers 
undergo an “Enhanced Reliability Check” (which includes a criminal 
history check) and are subject to the same legal obligations as all 
StatsCan employees. They carry identity which can be verified by call- 
ing a telephone number supplied. 


30 


The individuals’ identity is not entered into the data base and the data 
is encrypted before transmission to Ottawa. At that point, the paper 
questionnaires are sent for archiving where staff detach the householder 
information. The only link between paper and data is an identifying 
number on the questionnaire which could be linked back to the paper 
responses. However, StatsCan has no interest in identifying respondents, 
except for data verification. . 


Making the survey mandatory achieved the desired objective of 
increasing participation (the rate rose by about 12 per cent) but may 
have affected the statistical accuracy by encouraging some unhappy 
respondents to be less than candid (or thorough). StatsCan has decided 
to return to voluntary participation for the next survey and to com- 
pensate by increasing the sample size to 27,000. 


Unfortunately the informational material for the new Survey of 
Household Spending is less than forthright on the legal options avail- 
able to selected respondents. The notification letter advises that the 
interviewer “will visit you” and asks for “your support in completing a 
questionnaire” but does not explain that participation is voluntary. An ~ 
accompanying brochure acknowledges “while your participation is vol- 
untary, it is important for all selected households to participate...”. It 
continues assuming that “the interviewer comes to your home...” and 
that “the interviewer will go though the questionnaire with you”. No 
alternatives are offered. 


The Commissioner concluded that while Statistics Canada undoubted- 
ly has the legal authority to conduct the FAMEX survey, it had not 
been frank with respondents about why it was collecting the informa- 
tion and how it would be used. On that basis he considered the 
complaint well-founded. 


No tax information without the taxpayer’s consent 


The introduction of new seniors benefit plans in Alberta and Ontario 
led to a number of complaints that the federal government was disclos- 
ing individuals’ income tax information to the provincial organizations 
administering the plans. Since the benefits of both plans are linked to 
income, the provincial bodies wanted confirmation of the applicant’s 
income — the most dependable source being income tax files. 
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Revenue Canada enters agreements with provincial government orga- 
nizations to provide specified tax information — but only with the 
taxpayer's consent. Among the issues raised by these complaints was 


¢ Did the applicants consent? 
e Was Revenue Canada the source of the information? 


¢ Were any disclosure kept to the minimum necessary 
to meet the programs’ goals? 


The Alberta Seniors Benefit Program 

This program entitles low-income seniors to certain anneal benefits. 
However, to qualify the senior must establish that their income 1s 
below the level set by the Alberta Ministry of Community 
Development (ACD) which administers the program. 


In an October 1994 Memorandum of Understanding, Revenue 
Canada and ACD agreed to “large volume transfers of taxpayer infor- 
mation in electronic media” on condition that ACD obtained 
taxpayers’ “proper written authorization”. Applicants were asked to 
sign a consent clause authorizing Revenue Canada’s disclosure to ACD. 
ACD kept the forms and, using seniors’ Social Insurance Numbers, 
submitted a bulk request to Revenue Canada beginning in 

November 1994. | 


Unfortunately, ACD did not check that all consent clauses were signed 
and simply submitted the entire list of applicants to Revenue Canada. 
Among the 60,000 of the 194,000 total applications checked, 4,000 
lacked completed consents — and 12 contained outright refusals, sever- 
al of whom complained to Alberta Privacy Commissioner Bob Clarke. 
Given the implications for so many seniors, the complaints were 
merged into a general complaint sponsored by the Alberta Council on 
Aging to both the provincial and federal privacy commissioners. 


The two commissioners followed the trail from each end of their 
respective jurisdictions and met in the middle. Mr. Clarke examined 
ACD’s collection of the forms and request to Revenue Canada. This 
Office investigated whether Revenue Canada disclosed tax information 
without consent; whether it disclosed more information than was 
required, and whether the original authorization form for Revenue 
Canada’s disclosure to ACD met the requirements of the Privacy Act. 
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The federal investigator found that the first condition of the 
federal/provincial understanding was not met; ACD did not get proper 
taxpayer authorization before seeking the information from Revenue 
Canada. Revenue-Canada assumed that all individuals on the ACD list 
had consented and replied with a standardized printout on everyone, 
containing 75 fields of data. It was evident that Revenue Canada had 
disclosed the information improperly, albeit on the assumption that 
ACD had kept its part of the bargain. 


However, it was also obvious that Revenue Canada had disclosed far 
more information than was needed to confirm the taxpayers’ income 
= S.unessorimiionmanom rather than 12/1 he. limes include:detailéd 
breakdowns of income sources and exemptions (including alimony, 
charitable donations and medical expenses). 


The investigator was able to dispel suspicions that Revenue Canada 
was also disclosing “T-slip” information about non-filers to ACD. T-slips 
are statements of income sent to Revenue Canada about individuals 
who may not file a return; for example, a bank reporting a small 


amount of interest on a savings account. 
| 


The complaint investigation led ACD to purge the 1993 and 1994 tax 
information from its files and to first freeze, and then destroy, 1995 data 
in December 1997. Revenue Canada now supplies just the minimum 
required data, and routinely audits selected individual’s files to ensure 
they consented. 


The Commissioner considered well-founded the complaints of 
improper disclosure against Revenue Canada but by destroying the 
data, amending the memorandum of understanding, restricting the 
amount of future disclosures, and conducting regular audits of consent 
forms, the department had acted effectively to prevent a recurrence. He 
dismissed the complaint that the ACD form was not a valid consent 
under the Privacy Act. 


The Ontario Drug Benefit Plan 

Following introduction of the plan which subsidizes drug costs for 
low-income seniors, the Commissioner received 25 complaints about 
the federal government disclosing income information to the Ontario 
government — and through the computer system — to pharmacists 
filling seniors’ prescriptions. Some complainants cited Revenue 
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Canada; others, Human Resources Development Canada (HRDC). 
The investigator quickly determined that Revenue Canada had been 
approached by the Ontario government but refused to provide individ- 
uals’ tax data unless they consented. The focus then turned to HRDC. 


Income information became critical when the new plan took effect in 
July 1996. Now single seniors with incomes less than $16,018, and 
married seniors with incomes under $24,175, must pay a $2 dispensing 
fee. Those with higher incomes pay the first $100 each year, then a 
$6.11 dispensing fee for each subsequent prescription. 


HRDC obtains income information when individual seniors apply for 
the federal Guaranteed Income Supplement or Spouse’s Allowance. 
Because these benefits are linked to income, the application form asks 
for the senior’s income and indicates that it will be verified with 
Revenue Canada under an information sharing agreement. The match 
is not described in Info Source — as the government data matching pol- 
icy requires — or in the program’s information brochures. Info Source 
does describe sharing information with the provinces as a 

“consistent use”’. 


HRDC has provided the Ontario Ministry of Finance with monthly 
computer tapes of Guaranteed Income Supplement recipients since 
1975 under a sharing agreement to administer the provincial 
Guaranteed Annual Income Supplement (GAINS). These agreements 
are allowed under the Old Age Security Act to administer social, income 
assistance and health insurance programs. However, the agreement stip- 
ulated that the information would be used only for GAINS. The 
following year it was amended to allow the Ontario Ministry of 
Revenue to share the information with the provincial health ministry 
to issue an OHIP card entitling seniors to free drugs. 


At some point, for convenience, HRDC began sending separate tapes 
to the Ministry of Finance for GAINS, and to the Ministry of Health 
for OHIP. Since the drug card was available to all seniors, the OHIP 
tape included all Old Age Security recipients, not just low-income 
seniors, and contained new fields including date of birth, sex, language, 
SIN, dates of any deaths, and the amounts of both OAS and any sup- 
plements received for the current year. No other income information 
was provided. 
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Then, in January 1996, the Ontario Ministry of Finance asked HRDC 
whether the 1976 agreement would cover information sharing for the 
new income-linked drug plan. HRDC responded that the information 
could be used for the purposes specified in the original agreement. The 
Ontario Health Ministry concluded that the purpose was the same and 
used the OHIP tape to establish the drug benefit program. In August 
1996, HRDC determined that the existing sharing agreement did not 
authorize the new use. 


A series of meetings ensued to consider a new agreement, then were 
suspended until the parties could agree specifically what information 
the province needed to administer the new program. It was evident 
that a new agreement would have been essential to launch an income- 
linked program had HRDC not been routinely sending OAS and GIS 
payments information to OHIP. Without this information, OHIP could 
not have determined definitively who met the income test. 


It was also evident that HRDC had been regularly disclosing unneeded 


benefit information and that seniors had not been told. 


Resolution of the complaints led HRDC to stop sending OAS infor- 
mation to the Ministry of Health, to rescind the 1976 sharing 
agreement allowing the Ontario Ministry of Finance to disclose infor- 
mation to the Ministry of Health, and to amend the OAS/GIS forms 
and explanatory material to make it clear to applicants that information 
is shared with the province. 


The complainants were particularly concerned about pharmacists 
knowing their income in order to bill the correct amount. Although 
pharmacies are not subject to federal (or indeed any) privacy law, the 
investigator asked a local pharmacist for a demonstration of the on-line 
billing system. 


This pharmacist registered all clients into his/her computer system. 
When a senior filled a prescription, the pharmacist identified the client, 
entered the flat $6.10 fee and the cost of the drug and transmitted the 
information to the ODBP data base. ODBP responded with confirma- 
tion of the amount the customer is to pay; either the full cost of the 
prescription, the $6.10 fee if the $100 limit has been reached, or the 
subsidized $2.00 fee. While the pharmacist can infer the senior’s 
income from the fee charged, there is no disclosure of specific income. 
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Revenue Canada shares some tax data for B.C. Family Bonus 


Financial information — particularly income tax data — 1s very sensi- 
tive. Any suspicion that Revenue Canada may be sharing tax 
information prompts complaints, even when the recipient 1s a provin- 
cial government. 


One Revenue Canada disclosure led a member of Parliament to com- 
plain on his own and a constituent’s behalf. Revenue Canada was 
alleged to have shared individuals’ income tax data with British 
Columbia to determine who was eligible for the B.C. Family Bonus. 


The plan, which is income linked, is designed to help low income fam- 
ilies with child-rearing costs. B.C. residents are notified that they do 

not have to apply for the bonus “as it is sent automatically based on the » 
family’s yearly income tax return”’. | 


Revenue Canada administers income tax for all provinces (except 
Quebec) under agreements between the provinces and the federal 
Department of Finance. It also administers the B.C. family bonus 
entirely, identifying qualifying families from family income and a pre- 
determined formula and mailing out the monthly cheques. It notifies 
the Department of Finance of the total amount which is then deduct- 
ed from the provincial share of taxes remitted to the B.C. Department 
of Finance. Finally, Revenue Canada sends recipients’ names and 
addresses to the B.C. government which, in turn, sends out notices to 
qualifying families so as to gain provincial visibility for the program. 


The limited sharing of information took place under an interim agree- 
ment while a permanent Memorandum of Understanding was being 
drafted. The Income Tax Act allows Revenue Canada to disclose taxpayer 
information to a province “to administer a law of a province for which 
it can collect taxes” and to officials “of a province entitled to receive a 
payment”. The Privacy Act specifically allows this type of sharing “under 
an agreement or arrangement between the Government of Canada and 
the government of a province” (sub-section 8(2)(f)). As well, it allows 
disclosures permitted in any other Act of Parliament. 


The Commissioner concluded that the information sharing was per- 
missable and the complaint not well-founded. 


36 


Names and addresses not disclosed to mail order drug firms 


Late in 1995, personally addressed solicitations from a mail order phar- 
macy began arriving in the mailboxes of many public servants. The 
letters from MED ITrust or (in Quebec) La Pharmacie MARCEL 
Dubuc announced their agreement with the federal public service 
health care plan to supply prescription medications to members by 
mail. 


During the following weeks, 65 employees complained to the 
Commissioner that someone had disclosed their names, addresses and 
public service status to the companies — their suspicions focused on 
their individual employers. 


The investigation revealed that in August 1991, the National Joint 
Council (representing management and public service unions) recom- 
mended changes to the employees’ health plan to make it self-insured. 
The Treasury Board (the public service employer) awarded the contract 
for the new plan to Mutual Life Assurance Company. In an attempt to 
control costs, the Council opted to use a mail order pharmacy to lower 
dispensing fees and medication prices. The successful bidders for the 
contract were MEDItrust and La Pharmacie MARCEL Dubuc. 


In order to inform members of the new service, the Council asked the 
pharmacies to provide literature and blank envelopes to Mutual Life 
and the public service unions. The unions then mailed the literature to 
their members, and Mutual Life to members who had submitted med- 
ical claims since it took over the plan. 


The Commissioner was satisfied that there had been no improper dis- 
closure because employees’ names and addresses were not given to the 
pharmacies. However, he was concerned that the old health plan con- 
tract contained no privacy protection clauses. With the contract under 
review again, he asked Treasury Board to incorporate clauses dealing 
with government control and individual access to the medical data. 


Over several months, while the investigator pursued the contract provi- 
sions with the Treasury Board, the Council began reviewing its support 
of the mail order pharmacy. In March 1997, the Council advised mem- 
bers that “only a small number of plan members chose to enrol” and 
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thus the hoped-for savings had not materialized. Apparently the 
Council had not anticipated such a negative reaction to the use of mail 
order pharmacies. The plan was discontinued. 


Progress on the contract provisions was slow because Treasury Board 
staff were not convinced that privacy clauses were needed. As well, the 
new health plan provider, Sun Life Insurance Company of Canada, had 
not factored in any costs to put the clauses in place. 


Asked to review the proposed clauses the following summer, Office 
staff suggested that since Sun Life was a signatory to the Privacy 
Guidelines of the Canadian Life and Health Insurance Association, it 
use that model for the contract clauses. Ultimately, the contract signed 
in the fall of 1997 bound Sun Life to the Canadian Standards 
Association Privacy Code. The code gives individuals access to their 
plan records and limits disclosures of personal information to the 
employer (except for legal action, fraud or audit). 


Parks Canada plays nanny 


An Alberta woman complained to the Commissioner that Parks 
Canada (part of Canadian Heritage) had her supervisor monitor her 
comings and goings while she was on unpaid leave to care for 


her child. 


Notes on her whereabouts, including her visits to the supervisor’s 
neighbour, a museum and a local gas station —— and observing whether 
the child was with her — were found in the work diary of the 
woman's supervisor. Apparently a human resources manager had 
instructed the supervisor to record the details because the woman was 
a “problem employee”. 


The information came to light 1n the department’s response to a 
comprehensive and formal privacy request the woman filed at the 
privacy investigator’s suggestion. Several earlier informal requests to 
see her personal files had not turned up several documents she 
believed existed. 


Why the woman’s behaviour needed documenting was a puzzle. “Leave 
without pay” 1s granted under the public service collective agreement 
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and cannot be refused. Employees’ jobs are not kept open during this 

type of leave (they have priority for available jobs should they choose 

to return to work). Parks Canada maintained that since it had granted 
the woman “care and nurturing” leave, it was responsible for ensuring 
that she was indeed looking after her child — an extraordinary incur- 
sion into an employee’s private life. 


There is no conceivable reason for an employer to be concerned with 
an employee’s daily routine while on unpaid leave because there can be 
no “abuse” of the leave. Even surveillance of current paid employees 
would need to meet the most stringent tests — employers should have 
no right to dictate how employees live their private lives. 


The Commissioner described the diary entries as “a form of surveil- 
lance” which the department had no justification for conducting. The 
complaint was well-founded. 


The department agreed to remove and destroy the information in the 
admunistrative files as part of its resolution of the woman’s grievance. 
However, officials resisted the Office’s request to also remove the mate- 
rial from its privacy unit files, arguing that it should be kept for at least 
two years after the last administrative action which was resolving her 
complaint. 


This two year minimum is designed to allow individuals a reasonable 
time to access personal information in government records. Since the 
information should not have been collected, and the complainant has 
seen it and wanted it destroyed, the Commissioner urged the depart- 
ment to grant her request. The department eventually agreed and the 
Commissioner considered the matter resolved. 


Video surveillance “excessively intrusive” — and unjustified 


Of all the tools in an employer’s arsenal, covert surveillance of its 
employees is surely one of the most intrusive and thus should meet the 
most rigorous tests. A complaint against the Immigration Refugee 


Board (IRB) illustrates. 


A lawyer representing a refugee applicant told the IRB that within 
hours of her client’s in camera hearing, a third party told the refugee 
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that her application had been approved. According to the refugee, the 
third party had been seen in the company of an IRB employee whom 
she described. The lawyer complained to IRB. 


Concerned about the leak of information and a possible internal 
source, Board security staff began an internal investigation. Security 
staff focused on the employee based on the refugee’s description which 
appeared to match the employee — a clerk in one of the regional 
offices. IRB senior management approved the use of a camera which 
remained in place until a Public Works technician moved some ceiling 
tiles during routine maintenance and dislodged it in the employee’s 
presence. IRB then removed it. 


The Commissioner concluded that the Board’s evidence was insuffi- 
cient to warrant such excessively intrusive surveillance; it amounted 

to hearsay and the employee’s acquaintance with the third party. The 
investigator determined that security staff had never considered con- 
fronting or consulting the employee. As well, using a video camera 
(without audio capability) trained on the clerk’s desk begs the question 
of what useful information it could possibly have captured. Presumably 
_ an employee leaking information would not do so in the middle of the 
employer’s premises 1n full sight of everyone. And, without audio, the 
camera would not capture compromising phone calls. 


The Commissioner questioned the Board’s resorting to covert surveil- 
lance on mere suspicion. “In my view, surveillance should only be 
carried out after conducting a thorough preliminary investigation that 
would lead an employer to have reasonable cause to suspect an 
employee of wrongdoing, and only after all other investigative tech- 
niques have been exhausted or considered to be ineffective” he wrote. 
He asked for the Board’s representations. 


The Board responded, acknowledging that “in hindsight, an investiga- 
tion by a law enforcement agency would have been preferable”. The 
Board had apologized to the employee and drafted a policy to guide 
staff in any future incidents. While the Commissioner applauded the 
intent, he had several recommendations on the specifics. (See below.) 


The Commissioner concluded that although the Board had reason to 
be concerned about leaks, and an obligation to protect personal infor- 
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mation, its investigation method was excessive given the dearth of evi- 
dence. He considered the complaint well-founded. 


Needed: A government policy on employee surveillance 

Not content to leave the matter there, the Commissioner wrote to the 
Treasury Board urging it to draft a government-wide policy on covert 
employee surveillance. As a foundation, he offered the recommenda- 
tions made to IRB. 


His recommendations were both general — concerning any investiga- 
tion of employees — and specific. Any policy on covert video 
surveillance should satisfy all the following requirements: 


¢ reasonable grounds to suspect serious misconduct, which may include 
criminal misconduct, must exist before covert video surveillance is 
considered an investigative option; 


¢ use only when all other reasonable measures, including non-inves- 
tigative measures such as counselling, workplace notices and 
education programs, have proven ineffective or are likely to prove 
ineffective; . 


¢ do not use where individuals have a reasonable expectation of priva- 
cy (for example, change rooms). If the alleged conduct under 
investigation 1s believed to be criminal, police should be asked to 
investigate. This will ensure a court review since police must first 
obtain a warrant to conduct covert video surveillance where there 1s 
a reasonable expectation of privacy; 


¢ where individuals do not have a reasonable expectation of privacy, 
authority to order covert video surveillance should rest only with the 
head of the government institution personally, and not be delegated; 


¢ to the extent possible, covert video surveillance should not intrude 
on the privacy of persons other than the individual under investiga- 
tion; 


¢ the surveillance must not continue longer than is reasonably neces- 
sary to conduct the investigation; 


4] 


* access to the videotape and any information generated by the video- 
tape must be strictly limited to those who have a legitimate 
investigative need for the information, and must not be used, for 
example, as a vehicle for monitoring employee performance general- 


ly; and, 


¢ the individual placed under covert video surveillance must be noti- 
fied afterwards about the surveillance, including where and when it 
occurred, and the justification for the surveillance, unless there are 
compelling reasons not to do so. 


Using postcards risks immigration disclosures 


Like anyone else faced with workload volume and time limits, public 
servants look for faster and more efficient ways of doing business. All to 
the good providing individuals rights are respected. However, when the 
Canadian Consulate in Buffalo, N.Y. began acknowledging immigra- 
tion applications on an open postcard rather than 1n a sealed envelope, 
a Toronto consultant complained that using postcards effectively dis- 
closed that the person was an applicant. 


The investigator found that the Buffalo consulate was temporarily 
snowed under with 5000 immigration applications. The sudden influx 
was caused by applicants trying to have their cases locked in under old 
regulations before the new ones took effect on May 1, 1997. The 
Buffalo office is the only mission in the United States which can 
accept immigration applications. 


To acknowledge the applications quickly, the consulate had resorted to 
cards on the face of which appeared the applicant’s name, file number 

and the notation that the individual’s “application for permanent resi- 

dence has been received”’. 


Citizenship and Immigration headquarters alerted both the Buffalo 
consulate and all missions abroad that open cards risk improper disclo- 
sures of personal information. The consulate switched back to sealed 
form letters and the complainant was satisfied. The complaint was con- 
sidered resolved during investigation. 
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CRTC refers cable billing complaints to industry council 


Many Canadians are under the impression that complaints about 
broadcast content and cable billing are the turf of the Canadian Radio- 
Television & Telecommunications Commission (CRTC). Not so. The 
misunderstanding led a Toronto man to complain that the CRTC had 
improperly disclosed his complaint about a local cable supplier to the 
Cable Television Standards Council, and to the cable company. 


As part of its 1988 regulatory reform, the CRTC encouraged the 
broadcasting industry to assume responsibility for dealing with disputes 
over such issues as subliminal and sexist advertising, violence, content 
of children’s programming and lotteries. The cable sector was also to 
deal with billing and service complaints. 


Broadcasting sectors were asked to develop industry standards and sub- 
mit these for CRTC acceptance. Compliance with the standards and 
complaint resolution is overseen by industry councils for each sector 
— in the case of cable TV, the Cable Television Standards Council 
(CHSC) 


The man’s complaint to the CRTC about billing irregularities and 
rude treatment by company staff was forwarded to the council which, 
in turn, sent it to the cable company. The company is required to 
respond in writing and, if its response is unsatisfactory, the complainant 
can take the matter to the council. Member cable companies are 
bound by council decisions. 


Given the new scheme, the disclosure allowed the company to respond 
and the council to see that the problems were resolved. The complaint 
was not well-founded. Although the man was satisfied with the investi- 
gator’s explanations, he continued to be upset that neither the CRTC 
or the council had followed up with him. The CRTC considers billing 
arrangements a matter between subscriber and cable company and 
closed its file. 
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New personnel numbers will end disclosure of SINs to union 


Another complaint about the ubiquitous number concerned Canada 
Post’s disclosure of employees’ SINs to the Canadian Union of Postal 
Workers (CUPW).The employee’s union membership card displayed 
his SIN and it had also been given to an insurance company. 


The investigator established quickly that Canada Post had disclosed the 
information and was simply complying with the terms of its collective 
agreement with CUPW. Canada Post’s payroll system uses SINs and the 
union argues that it needs to identify its members in the system. As 
well, members in good standing are covered by an insurance policy 
held by the union, and can buy additional coverage. Since administra- 
tion of this coverage is also tied into the Canada Post payroll system, 
CUPW gives members’ SINs to the insurance company. 


The Public Service Staff Relations Board has ruled on several occasions 
that employees’ SINs must be provided to unions, despite the restric- 
tions in the Privacy Act. Nevertheless, the Commissioner 1s concerned 
about the practice and encouraged the Department of Justice to appeal 
one of the cases. In the meantime, Canada Post is converting to a 
Human Resources Identification Number to replace the SIN. The con- 
version was on hold at that point as Canada Post prepared for the 
strike. Once completed, disclosures of SIN will end. - 


Any question about union or insurance company use of the numbers is 
outside of the Commissioner’s jurisdiction. 
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Inquiries 


Inquiries are all those calls and letters which do not fit the definition of 
“complaints” to the Privacy Commissioner. Inquiries can include 
requests for general information and publications about the act, com- 
plaints about organizations not covered by the Act — Crown 
corporations, provincial and municipal governments or the private sec- 
tor — and privacy issues beyond protecting personal information. 


This past year, the two inquiries officers handled 10,331 requests on 
everything from access to adoption records, to disclosure of credit and 
financial information, and use of surveillance cameras on street corners. 
Many calls dealt with questions surrounding the matching of Canada 
Customs’ Tiavellers Declaration Cards with Employment Insurance data, 
some of them seeking advice on handling appearances before Boards of 
Referees and Umpires. While the Office cannot give legal advice to 
individuals caught up in the process, staff did provide callers copies of a 
letter setting out the Commissioner’s position on the match. 


The mailing of the B.C. Benefits consent letter with its comprehensive 
collection statement (see page 82) flooded the telephone lines with 
calls, some of them seeking the federal commissioner's intervention to 
effectively “overrule” the provincial government. Of course, the federal 
commissioner has no jurisdiction in provincial matters and referred 
calls to both the provincial privacy commissioner and the caller’s MLA. 


The Toronto Dominion Bank’s new privacy brochure also moved many 
to call, objecting to the bank’s requirement that customers opt out of 
its plans to share information with subsidiaries. Customers had until 
October 1997 to indicate their preference. No news meant the infor- 
mation would be shared. While privacy advocates prefer active over 
passive consent, opting out meets the consent test set out in the 
Canadian Bankers Association Privacy Code, and the Canadian 
Standards Association Code on which it is modelled. 


Inquiries officers have been enlisted in the Office’s quest to deal with 
some matters quickly and informally, whenever possible. In one case an 
MP’s office called to alert the Commissioner that Human Resources 
Centres in Newfoundland were asking EI claimants picking up 
cheques during the postal strike, to sign a receipt which listed all 
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claimants and the amounts of the cheques. Everyone picking up a 
cheque could see who else was drawing EI and how much. 


The inquiries officer confirmed the story with HRDC staff and asked 
them to intervene quickly. Apparently the practice was confined to 
Newfoundland and the Windsor, Ontario area. HRDC headquarters 
staff alerted the regions which switched to individual receipts, the prac- 
tice in the rest of the country. The problem was resolved the following 
day. 


Inquiries by type 


The following table breaks down the inquiries into broad categories. 


Noi jurisdiction, federal 

No jurisdiction, private sector . . 7, 
‘Beairect to provincial commissioner Y 

: Redirect to other federal agency 

Redirect to other 

Social hi Insurance Numbers — 


Financial inst., insurance, credit 


Telecommunications | 
Telemarketing, direct nae behvin 
Criminal records, pardons, U. S. waivers” 
Medical 

‘Adoption, genealogy, missing persons. 
Other } 


46 


12000 


10000 


8000 


6000 


4000 


Inquiries 1987-98 


= 
Si 
= 
a 


91-92 


92-93 


93-94 


94-95 


95-96 


96-97 


97-98 


47 


Top Ten Departments 
by Complaints Received 


nto oom [et [oe [at [oh 


enue ‘Canada 


a 


48 


Completed Investigations 
by Grounds and Results 
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Completed Investigations 
by Department and Result 


Agriculture and Agri-Food Canada 


Bank of Canada 


Canada Deposit Insurance 


Canada Ports Corporation 


Canadian Heritage, Department of 
Canadian International Dev. Agency 


| veld Security Intelligence Service 
Citizenship and Immigration Canada 
Correctional Investigator of Canada 
pel cnola cana 

Farm Credit Corporation Canada 
Foreign Affairs and int. Trade Canada 


Human Resources Development 
Canada 


Indian and Northern Affairs Canada 


50 


Completed Investigations 
by Department and Result (cont'd) 
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A better window on privacy issues 


The Privacy Commissioner’s main function is to investigate complaints 
stemming from alleged breaches to the Privacy Act. But the 
Commissioner does more: two other components of his mission are to 
be an effective privacy guardian on Parliament’s behalf, and to be 
Parliament’s and Canadians’ window on privacy issues. 


These two roles demand that the Privacy Commissioner be able to 
give a professional assessment of the quality of the federal government's 
adherence to the Privacy Act, and his research and communications 
activities provide legislators and the general public with the facts neces- 
sary to make informed privacy judgments. These two responsibilities 
have now been merged in a single branch called Issues Management 
and Assessment/Fair Information Practices. 


In 1994, following a major overhaul of all government institutions, the 
Office’s former Compliance Branch changed the way it did business. Its 
small staff could no longer afford to conduct traditional reactive audit 
and follow-up activities. A new branch was created to focus on moni- 
toring new legislation and programs and providing active advice and 
suidance to federal agencies. These agencies were grouped into four 
main envelopes, each assigned to a portfolio leader. 


The past four years, however, have demanded further changes to enable 
the Commissioner to accomplish this part of his mission. Experience 
has taught portfolio leaders that not all agencies in their portfolios 
require equal attention. And major issues have recently surfaced in the 
federal government that require considerable involvement from portfo- 
lio leaders, often working as a team with one agency. 


A good example is the still-ongoing restructuring of all of Human 
Resources Development Canada activities. As manager and delivery 
agent of many social programs, the department has the most extensive 
personal information holdings in all of the federal government. It also 
relies heavily on application of state-of-the-art information technology. 
Reviewing its performance required a coordinated effort of all portfo- 
lio leaders, with input from policy and research staff. While the notion 
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of portfolios remains useful, it can no longer be absolute; portfolio 
leaders will increasingly work on critical issues, whether confined to 
one agency or spread across government. 


As well, the Office relies on a handful of policy analysts and research 
staff to perform four other key activities: monitoring issues and devel- 
opments in Canada and abroad, researching specific topics of interest or 
urgency, developing positions and policies on new legislation, programs 
and issues. The branch 1s also a critical component of the 
Commissioner’s public communications efforts, offering presentations 
and speeches to federal agencies and businesses, doing media inter- 
views, replying to inquiries, monitoring new legislation and preparing 
submissions to Parliamentary Committees and government agencies, 
and participating in joint projects involving public or private sector 
agencies. These activities may well have had the most public impact in 
the ,Oftice’s) 16:-years of: existence; 


But with the pace of societal and technological change accelerating in 
Canada and abroad, the Office must now step up and refocus its 
research and policy work. Our answer has been to merge portfolio and 
research/policy staff to help feed and support one another. Essentially 

_ all of this report’s material not dealing with specific complaints or legal 
matters are the product of this unit. 
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Electronic Commerce — 
A marketer’s dream... a privacy nightmare? 


The advent of “electronic commerce” virtually transforms the way we 
shop and do business. Electronic, or e-commerce, generally means the 
commercial transactions that take place between individuals and orga- 
nizations over computer networks. 


Certainly, this new kind of commerce offers huge potential for busi- 
nesses to reach new customers, and for customers to reach businesses. 
Although much of current e-commerce focusses on buying services — 
such as banking on-line — rather than products, governments and 
businesses around the world are actively engaged in establishing a 
framework for purchasing goods electronically. 


To help prepare Canada for the electronic marketplace, the federal gov- 
ernment recently released two discussion papers; one dealing with 
protecting personal information in the private sector, and the other 
with encryption of electronic communications. Depite the initiatives, a 
lot of work remains to be done to protect the privacy of Canadians. 
Please see pages 11 and 60 for more detail on, and the Commissioner's 
response to, these initiatives. 


These discussion papers, and the initiatives they propose, are on a tight 
schedule. They form part of the federal government’s preparation for 
the Organization for Economic Co-operation and Development 
(OECD) and Government of Canada Muinisterial-level conference on 
electronic commerce to be held in Ottawa in October 1998. 
Thankfully, protecting privacy is on the conference agenda. Work 1s 
also underway to tailor the OECD’s 1980 Privacy Guidelines to today’s 
global networks. The OECD proposes presenting these guidelines to 
the Ottawa Conference in October for endorsement. 


OECD member countries seeking to build effective privacy protection 
should consider a more recent and forceful initiative than the old 
OECD guidelines that were developed before electronic commerce 
was ever contemplated. An excellent foundation could be the EU 
Directive on protecting personal information which, beginning in 
October 1998, will protect the privacy of over 350 million European 
citizens in both the public and private sectors. 
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The federal government wants to be seen to be a world leader in elec- 
tronic commerce, and understands that Canadians’ trust in networks 1s 
fundamental to their participation. However, central to the interaction 
between information technology and the personal information it 
processes is the degree to which we respect each other as individuals. 
We know that technological change is making a shambles of the right 
to privacy. The measures the federal government has taken to date will 
be insufficient to protect privacy given the dangers that are inherent in 
electronic commerce. 


Consider one of the newest methods of collecting personal informa- 
tion — capturing data sent over the Internet. Any move we make and 
information we submit online feeds valuable information to a huge 
market for personal information. Without your knowledge, and certain- 
ly without seeking your consent, a record 1s kept of every screen on 
every Web site you visit. Collecting this so-called “clickstream” data 
allows others to gather information on all the services or products that 
you buy online. But this information could also be matched with your 
Web surfing habits to develop a very personal profile of your prefer- 
ences and dislikes — a marketer’s dream. 


A consensus seems to have formed that people should be forced to 
identify themselves when they want to buy something on a network. 
However, many of the face to face transactions that we now conduct 
are anonymous — a cash purchase, for example. Insisting that we reveal 
our identity to engage in electronic commerce would end a long histo- 
ry of anonymity and create new and more detailed trails of personal 
data that would chart our every move. 


The development of new services (see Internet — still no privacy, 

page 65) may well enhance users’ privacy. However, it is difficult to 
evaluate their merit because thinking about privacy in electronic com- 
munications is still in its infancy. One thing is certain; Canadians must 
become better informed about how technologies can lead to the mis- 
use of their personal information. Once we understand that 
organizations can choose to use technology responsibly or irresponsi- 
bly, then we can hold organizations’ management — rather than the 
technology — accountable. 


09 


Can we keep a secret? 


In this age of computers, personal communications devices and global 
networks like the Internet, we rely heavily on a technology that is not 
secure. Anyone can access our data and our communications unless we 
take special steps. 


Fortunately, the technology also exists to prevent unauthorized access. 
Encryption transforms our voice communications, electronic mail, 
computer documents or fax communications into code during trans- 
mission and storage. Even if others gain access to the message, they 
cannot understand it without the proper code. Encryption provides an 
added benefit; it also allows us to confirm the identity of the sender, 
and that the communication has not been altered in transit. 


An encryption primer There are two main cryptographic methods. 
The first, “private key”, uses the same code (or “key’”’) both to trans- 
form information into meaningless strings of characters, and to undo 
the transformation. Both sender and receiver must protect their key. 


The second method, “public key”, uses two keys working together: a 
public key which the sender uses to transform the information before 
sending it, and a secret key, known only to the recipient, which is used 
to decode the message. The secret key can unlock only the information 
transformed by its corresponding public key. This method 1s increasing- 
ly popular because it is much easier to use on a large scale. Publishing a 
public key is a one-time step, rather like publishing one’s telephone 
number. Disclosing our private key to every person with whom we 
might want to communicate could become onerous and, once dis- 
closed, the key could be beyond our control. 


The effectiveness of a cryptographic product relies on the length of the 
keys it uses, measured in “bits” (one letter or digit in a word or number 
is a bit). Cryptographic keys are mathematical formulas which can 
range from eight to over 2000 bits 1n length (most are between 40 and 
128 bits). The higher the number of bits, the more secure the key 
because the longer it would take to decode. To illustrate, it would take 
less than four hours to decipher a 56-bit key using today’s technology, 
but multi-million years to decode a 112-bit key! 


60 


On the other hand... So cryptography may have solved the electron- 
ic security problems. But there, according to law enforcement officials, 
is the rub; if you can protect your communications by encrypting 
them, so can criminals. And if they cannot access and understand coded 
information, police argue, they cannot enforce the law effectively. Thus 
law enforcement officials want us to use cryptography only if they can 
have the keys to unlock the coded information. This proposal is not 
unique to Canada: police forces from many Western industrialized 
countries seek similar conditions, and have agreed (in the “Wassenaar 
Arrangement”) to control the use of cryptography. 


In this instance, however, law enforcement interests run directly 
counter to the individual’s privacy and to business interests. Few will 
want to use the Internet to send sensitive information such as a med- 
ical record, a credit card number or proprietary secrets if this 
information is not protected. The proposal is somewhat akin to requir- 
ing everyone to give local police the keys to our homes in case we 
might commit a crime in the future and they need to enter. 


The scope of this proposed access is unparalleled and moves us a step 
towards a police state. The proposal could also be counterproductive. 
Public knowledge that our electronic communications would be either 
unprotected or open to law enforcement interception could weaken 
public confidence and thus reduce the power and appeal of such pro- 
jects as electronic commerce. 


With an evident need for a policy, and the debate raging, the federal 
government issued a discussion paper in February to consult 
Canadians. The government focused on the use of cryptography for 
electronic commerce, and sought comments in three policy areas: 
access to stored information, access to communications, and restrictions 
on the export of cryptography products using keys longer than 40 or 
56 bits. 


The Privacy Commissioner’s submission observed that “the broad 
interception and decryption capabilities sought by law enforcement 
agencies may not be the most appropriate solution to the problem of 
criminal activities, and may violate Canada’s Charter of Rights and 
Freedoms. Indeed, law enforcement agencies have not proven that the 
interception and decryption capabilities they are seeking will lead to a 
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decrease in criminal activities.” The onus 1s on government to demon- 
strate an overwhelming public interest before overriding our right to 
have private communications. 


The Commissioner also recommended that 
e All Canadians should have access to cryptography; 


¢ Canadians should be able to choose freely whichever 
cryptography product, if any, they want to use; 


¢ Canadians should be able to decide freely on how to 
handle their cryptographic keys; 


¢ Cryptographic keys and coded information should be 
stored securely; and 


¢ All electronic commerce activities should allow cryptography. 


Industry Canada is now reviewing responses to its discussion paper. 
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Stick Before Carrot 


Treasury Board Secretariat Policy 
on the Use of Electronic Networks 


The federal government increasingly relies on electronic networks — 
the Internet and electronic mail systems, among them — to conduct its 
operations. Understandably, government is concerned that employees 
use these networks only for government business and not for unlawful 
or unacceptable purposes. 


In February 1998, Treasury Board Secretariat published its “Policy on 
the Use of Electronic Networks”. Among the requirements the policy 
imposes is a duty for each organization’s senior official to develop state- 
ments for employees indicating that unlawful activity is not permitted 
on these networks, and that certain other activities may be lawful but, 
nonetheless, unacceptable. We applaud the policy on this point, since 
these statements will help clarify the expectations of employers and the 
rights of employees. | 


The policy allows an organization to refer suspected misuse of net- 
works to an appropriate official for investigation under two conditions: 
if it receives a complaint; or if its routine analysis of electronic net- 
works (which does not involve reading the content of electronic files 
or mail) leads it to suspect that a person 1s misusing the network. 
Investigation may involve special monitoring or reading of the contents 
of electronic mail and files. 


The policy also deals with government employees’ expectation of pri- 
vacy. It notes the Charter of Rights guarantees that give government 
employees a right to a reasonable expectation of privacy, even if the 
employees are using government computers. However, the policy seems 
to suggest that an employer can diminish that reasonable expectation of 
privacy by telling employees that monitoring will occur. 


This position seems to imply that simply telling employees that their 
electronic activities will be put under increased surveillance reduces the 
right to a reasonable expectation of privacy. If that were the case, then 
other types of highly intrusive employer surveillance — such as putting 
cameras in washrooms — might also be permitted simply by telling 
employees it would happen. Such an interpretation (we hope unin- 
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tended by the Secretariat) could lead to the serious and arbitrary ero- 
sion of the privacy of government employees. 


We are not saying that surveillance of employees is never justified. 
However, we are deeply concerned about a policy that might see 
federal employers assuming a broad right to monitor the electronic 
activities of employees without specific justification. 


At a meeting with Treasury Board staff to discuss an earlier draft of the 
policy, we raised several points, including the following: 


¢ A government policy that allows extensive intrusions will almost 
certainly be held up by the private sector as justification for similar 
intrusive policies. Therefore, the government policy should go no 
further than 1s absolutely necessary to achieve the government’s 
legitimate goals as employer; 


¢ It is preferable, whenever some intrusion is warranted, to use the least 
intrusive option first. This means starting with education setting out 
clearly the acceptable and unacceptable uses of electronic networks. 
Only if that does not resolve the problem should intrusive solutions 
such as monitoring be considered acceptable. 


Treasury Board Secretariat did make some adjustments based on our 
recommendations. However, the final policy still contains excessive 
powers of intrusion. In particular, the Secretariat appears to have reject- 
ed our call to use the least intrusive measure first, moving to greater 
intrusion only if the less intrusive measures proves ineffective. The poli- 
cy clearly contemplates monitoring the contents of e-mail and the 
Internet web sites visited, yet does not provide sufficient limits on 
when such intrusive measures can be used. 


In addition, the Secretariat appears to consider e-mail inherently less 
private than a telephone conversation, since the policy envisages moni- 
toring e-mail without the consent of the sender or recipient. 
Monitoring of a telephone in this manner would be a criminal offence. 


Federal employees may not all be angels. Some, like their private sector 
counterparts, may not be entirely productive or honest in their deal- 
ings. However, that does not justify making all federal employees, most 
of whom can be trusted to act perfectly responsibly, the target of heavy 
handed monitoring. 
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Internet — still no privacy 


The 1995-96 Annual Report gave readers some tips on how to protect 
their privacy on electronic networks (Privacy in Cyberspace: a Surfer’s 
Guide). Two years later, the Internet has become much more commer- 
cial (to the point that some governments are looking at ways to tax 
on-line purchases!), and privacy 1s at even greater risk. There are cur- 
rently four main types of privacy invasions on the Internet: 


On the World Wide Web 


The biggest Internet privacy invasion is the collection of your personal 
information without your knowledge — information that can be used, 
rented or sold to on-line and other direct marketers. And this applies to 
both information about yourself and about your activities on the Web... 


¢ Your electronic mail (“e-mail”) address, sometimes your name, your 
Internet Protocol (“IP”) address (from which your rough geographi- 
cal location can be inferred using a domain name lookup service), 
the type of browsing software you use (and by implication, the oper- 
ating system of your computer). Fortunately, most of this information 
can be withheld from Web sites if you first surf through such sites as 
the Anonymizer, at [www.anonymizer.com]. 


¢ Information about your activities on the Web (also known as “click- 
stream information’): who you are, when you enter a site, the last 
page you accessed (required for the BACK function of your brows- 
er), which sections of a site you go to and how much time you spend 
on each, what documents (or pictures) you download onto your own 
computer, and what information you search for with such well- 
known tools as AltaVista or Yahoo. As above, your clickstream 
information can be also be anonymized by first going through cer- 
tain sites. 


Web sites may also store some of this information on your own com- 
puter in the form of a “cookie” file. This allows the site to retrieve the 
information at your next visit, and “personalize” its greetings. However, 
you can instruct your computer to refuse such cookie files. 
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As well, some municipalities and government institutions are increas- 
ingly interested in using the World Wide Web to post information for 
the general public. While the intended convenience is usually laudable, 
the end result can be disastrous. The cities of Victoria, B.C. and Aylmer, 
Québec (among others) had to remove sensitive financial information 
from the Web following the public outcry that ensued. While tax rolls 
are usually publicly available information, it is a quantum leap from a 
personal consultation of tax records at a local city hall to providing 
over 40 million computer users worldwide a person’s address, property 
value, taxes owing and (in some jurisdictions) religious affiliation — all 
from the comfort of their homes. Similarly, Manitoba Telephone 
Systems had to remove billing information from the Web following 
protests by its subscribers. 


On the Usenet 


Participating in discussion groups on the Usenet can lead to a second, 
less well known privacy invasion. Every message you post to a discus- 
sion group is archived for others to search. Not only are your personal 
views On a given topic stored permanently, it is also possible to search 
the Usenet to find out which discussion groups you participate in, and 
thus determine your interests (DejaNews — the message archivist — 
does allow you to delete selected messages). Even worse, it is also possi- 
ble to find out who 1s looking at a message at a given moment! 


Writing e-mail 


You will never hear it enough: e-mail on the Internet is as private and 
secure as a post card in the “snail mail”. Everyone from your Internet 
provider staff to your correspondent’s friends or colleagues can read 
your electronic message from the moment you click “SEND” on your 
computer. Unless you and your correspondent use encryption (see Can 
we keep a secret? page 60), avoid including sensitive information such as 
credit card numbers, vacation dates or medical information in your 
electronic messages. You could also use anonymous remailers which 
forward your message, and sometimes the reply, without including any 
personal information. Among others, you can find a good list of those 
remailers at our Web site. 
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Another privacy invasion prompted by e-mail 1s junk electronic mes- 
sages, better known as “spam”. Once an on-line direct marketer gets 
hold of your e-mail address, you will find unsolicited electronic adver- 
tising in your mail-box. Because junk e-mail is as much a nuisance as 
regular junk mail, and because it is costly to you (keeping you con- 
nected while you receive, read and delete the junk messages), most 
Internet Service Providers (ISPs) have devised ways to block spam from 
your e-mail box. Inquire! 


Hacking 


Hacking 1s the unauthorized access to computer systems and files. And 
the best electronic protections (such as “gateways” and “firewalls”) can, 
and do, fail. Because the Internet is nothing more (and nothing less) 
than a worldwide electronic computer network, it is a hacker’s paradise. 
Getting access to your ISP’s file listing of all of its users’ names and 
passwords would be a dream for a hacker who could then read, redi- 
rect, change or delete your e-mail without your knowledge. Some 
hackers prefer shopping and try to hack ISP or Web site files contain- 
ing credit card numbers. Others are more interested in company or 
personal secrets and will look for interesting business or personal infor- 
mation they could resell or misuse. 


This is not just the stuff of movies: last year alone the best protected 
computers in the world; those of the Pentagon, the FBI and NASA 
were successfully hacked hundreds of times! And if you think your 
information is of little interest, think again: some hackers specialize in 
stealing enough information about you to impersonate you; ordering 
credit cards in your name, renting or buying in your name, holding a 
job in your name — leaving all the bills and income tax to pay (not to 
mention a reputation to rebuild) also all in your name! This is the 
srowing problem of “identity theft” which 1s exacerbated by electronic 
transactions. 


Are there solutions to all of these privacy invasions? 


Aside from these tips, there is little to protect your privacy on the 
Internet. Laws would be of little use because laws change from one 
country to the next, and the Internet knows no borders. Codes of 


67 


ethics (like the December 1996 Code of the Canadian Association of 
Internet Providers) are nice statements of intent but they are voluntary 
and useless if they are breached. Yet, two new solutions have recently 
appeared which could make a difference — if they work. 


The first is TRUSTe. Launched by a group of American companies and 
advocacy groups in June 1997, the program encourages Web sites to tell 
surfers about their privacy protection practices and what they do with 
the personal information they collect. Sites that subscribe to TRUSTe 
display the program logo or “trustmark” on their welcome page (and 
can be audited at random for compliance). Unfortunately, few sites 
have joined the program — by April 1998 it had attracted only 75 par- 
ticipants. Apparently one major factor in companies’ hesitation is 
TRUSTe’s sanctions for those which do not comply with the guide- 
lines. However, businesses that are serious about gaining clients’ trust by 
protecting their privacy in an electronic environment should embrace 
this attempt at self-regulation, rather than waiting for legislation to 
force them to comply. 


The second solution is the Platform for Privacy Preferences Project (or 
“P3P” for short). Begun in May 1997 by the consortium that oversees 
the development of the Web, the project allows surfers to specify their 
privacy protection preferences (through their browser), and Web sites 
their privacy protection practices. Surfers can then access compatible 
sites, and choose to either stay away from, or negotiate with, incompat- 
ible sites. P3P is still under development, however, and will not become 
fully operational for several months. Its future is uncertain, as is its 
popularity with Web site owners. 


When it comes to the Internet, the sad truth is that there still more 
money to be made by invading your privacy than by protecting it. 
Until that changes, beware! 
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But a useful tool 


Privacy Forum — an Experiment in Electronic Democracy 


For those who missed it, the government’s discussion paper on private 
sector legislation (see page 11) was made public January 24, and the 
window for comments closed on March 27! That left little time to get 
busy people from across the country involved in debating how the pri- 
vate sector should protect their personal information. 


But a coalition of public interest and consumer advocates from across 
Canada managed it. They mobilized at lightning speed to respond to 
the paper’s call for comments by building an interactive web site and 
discussion group called the Privacy Forum. 


The project was spearheaded by the Media Awareness Network, the 
Public Interest Advocacy Centre, Canada’s Coalition for Public 
Information, the Consumers’ Association of Canada, the Fédération 
nationale des associations de consommateurs du Québec, the Ottawa 
Public Library, and Telecommunities Canada. This Office provided 
administrative support. 


The Web site contained background information on privacy issues and 
links to other relevant sites, as well as an online survey for Canadians to 
express their views on privacy protection. The Forum also hosted a dis- 
cussion group to allow people to talk to one another about privacy 
issues. 


The purpose of the Forum’s survey was not to gather scientific polling 
data but rather to determine people’s responses to strongly worded 
statements about information privacy protection. The survey results 
revealed a strong consensus on several issues. 


One of the clearest messages — and one this Office heartily supports 
— is that respondents are dissatisfied with current information practices 
in the private sector. They expressed particular annoyance with tele- 
phone solicitations, junk mail, data trails and the general exchange and 
sale of personal information. 
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While respondents were quick to acknowledge that the government 
has privacy laws, many expressed concern about how governments col- 
lect and use personal information. Survey respondents also voiced 
strong support for keeping control over their personal information and 
not being penalized by companies for refusing to provide it. 


In addition, respondents felt that the complaint process should be sim- 
ple and it should have safeguards to ensure that companies are in 
compliance. Finally, virtually all respondents saw a need for education 
about privacy issues. 


Overall, the Privacy Forum web site was a great tool both to inform 
Canadians about privacy issues and to assess their responses. Hosted 
through a part of the Media Awareness Network’s web site called the 
Privacy Pages, the Privacy Forum had links and background material to 
spare. And inform it did. More than half of the 266 survey respondents 
said the Privacy Forum had both increased their understanding of and 
— perhaps more importantly — changed their minds about, privacy 
issues. Now that’s results. Who knows how many more people would 
have participated had there been more time; another 100 people com- 
pleted the survey after the deadline had passed. 


This experiment in electronic democracy was a resounding success, all 
the more considering the tight deadline. The coalition’s extraordinary 
effort to engage Canadians 1n the debate was one of the highlights of 
the whole exercise. 


A Privacy Playground for kids 


Making kids more informed Cybersurfers has been a priority of the 
Media Awareness Network since its launch in 1996. Now the Network 
has found a way to teach young children to protect their privacy on 
the Internet. 


In mid-May the Network released its Privacy Playground: the First 
Adventure of the Three Little CyberPigs game on CD-ROM. The _ 
game features the three little cyber-pigs and a big, bad cyber-wolf in 
interactive situations to teach children how to recognize invasive and 
deceptive online advertising, and the importance of not divulging per- 
sonal information online. 
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The Media Awareness privacy web site is also worth a visit for the 
largest Canadian collection of online educational materials on privacy. 


Looking forward to Private Eyes 


High school students have not been forgotten. Beginning this Fall they 
can participate in the Private Eyes Project which celebrates the 50th 
anniversary of the signing of the United Nations Universal Declaration 
of Human Rights. The Declaration recognizes the importance that pri- 
vacy plays in protecting human rights. 


The project is the brainchild of the Human Rights Research and 
Education Centre at the University of Ottawa with generous support 
from the Royal Bank of Canada, Canadian Heritage department, Sheila 
Finestone, MP, former chairperson of the Standing Committee on 
Human Rights and the Status of Persons with Disabilities, as well as 
this Office. The Law Room site is part of Canada’s SchoolNet. It pro- 
vides site visitors with several scenarios which challenge us to weigh 
the evidence and draw our own conclusions about the value of pro- 
tecting our personal information. An added bonus is the project’s 
practical information about the process of Parliamentary committee 
hearings and intergovernmental negotiation. 


Students will be make practical use of the information this Fall when 
schools across Canada participate in the interactive unit of the project. 
Schools are invited to conduct their own mock parliamentary hearings 
on privacy rights in the next century and then publish their findings in 
the Law Room. The next step will be to discuss the issues in a national 
online forum, then selected schools will negotiate an intergovernmen- 
tal agreement on privacy rights over the Internet. The agreement will 
then be submitted to participating schools for ratification. 


The entire Law Room site delivers high-quality educational materials 
on justice and human rights issues to teachers and students. Although 
designed for high school students, the site merits a visit from everyone 
who has questioned how technology is changing our lives, and how to 
balance technological progress and human values such as privacy. 


Links to both these sites are available through the Office’s Web site. 
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The Privacy Pages — Industry Canada’s 
Online Commitment to Privacy 


Industry Canada’s Task Force on Electronic Commerce has also devel- 
oped a web site which both explains the need for privacy when 
conducting electronic transactions, and provides a “Privacy Toolkit” to 
help people protect their personal information. 


The toolkit provides information on Consumer Education, Codes of 
Practice, Legislation and Privacy-Enhancing Technologies and, of 
course, a link to the Discussion Paper on private sector legislation enti- 
tled The Protection of Personal Information: Building Canada’s Information 
Economy and Society. 


You can link to Industry Canada’s Privacy Pages on our Web site. 
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The DNA Databank Bill — Still 


Last year’s annual report discussed at some length the DNA legislation 
that had just then been introduced in the House of Commons. The 
proposed DNA Identification Act sought to establish a DNA databank of 
samples taken from convicted offenders to help police identify those 
responsible for unsolved crimes. The bill was the second phase of the 
government’s plan to regulate DNA testing as a tool to identify 
unknown offenders who leave traces of DNA at the crime scene. The 
first phase of the law allowed police to obtain a warrant to obtain 
DNA samples from suspects and was enacted 1n 1995. 


With the April 1997 general election, the databank bill died on the 
order paper. In September 1997 the government introduced almost 
identical legislation, Bill C-3, several aspects of which give cause for 
concern. In his March 1998, appearance before the Standing 
Committee on Justice and Human Rights, the Commissioner made 
several recommendations, among them: 


¢ taking DNA samples only from those convicted of a violent offence 
for which there is a high risk of re-offending and a likelihood that 


genetic material would be left at the crime scene; 


¢ destroying the DNA samples after extracting the identification infor- 
mation, leaving only the analysis on police files, and 


¢ ensuring that DNA samples and analysis volunteered by individuals to 
help police exclude them as possible suspects, be destroyed immedi- 
ately after use and not be used for a “fishing expedition” to 
determine responsibility for any other crime. 


We remain troubled by pressure from some groups and politicians to 
impose automatic forensic DNA testing on anyone charged with an 
indictable offence, which could include acts as relatively minor and 
non-violent as swearing a false affidavit. DNA would then be taken 
from most criminal suspects (since most Criminal Code offences are 
indictable) almost automatically, as are traditional fingerprints. 
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The Department of Justice strongly opposed this attempt to expand the 
scope of DNA testing of suspects on constitutional grounds. We oppose 
expanded testing because it constitutes an excessive and unnecessary 
use of intrusive state powers that should be exercised only in tightly 
controlled situations, and only after a judge’s warrant authorizes the 


intrusion. 
As this report goes to press, the bill had been withdrawn. 


Position papers on both issues, compulsory collection of DNA samples 
from suspects in a specific crime, and establishment of a DNA database, 
are available from our office and at our Internet web site. 
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The Year on the Hill 


Canada Labour Code Bill C-19 


This legislation governs labour relations in federally regulated 
industries such as banking, telecommunications and transportation. The 
Commissioner expressed reservations about a number of amendments 
to the code contained in Bill 66 in the previous Parliament. With the 
calling of the 1997 election, the bill died on the order paper. 


A slightly modified Bill (now C-19) was introduced in November 
1997. In his appearance before the Parliamentary committee, the 
Commissioner highlighted two clauses which caused concern. The 
first, clause 50, states that unions will be able to communicate with off- 
site workers. Since this requires employers, and occasionally the Canada 
Labour Relations Board (CLRB), to provide the off-site workers’ place 
of work, for many that meant disclosing their home addresses. 


Pointing out that most individuals have a high expectation of privacy | 
at home, the Commissioner asked that the bill require workers’ active 
consent to disclose a home address, rather than an opt out. Union 
membership is not compulsory and unions could canvass off-site work- 
ers at the employer’s business address. For example, the Public Service 
Staff Relations Act requires federal government agencies to provide new 
employees with a union registration card which they can complete and 
return as they wish. Public service unions do not recetve home 
addresses from the employer. 


The second clause (54) specifically prevents individuals from having 
access to their personal information contained in notes taken by 
appointees of the CLRB or the Minister without the appointees’ 
consent. This appeared to provide the Board members, arbitrators or 
anyone assisting the Board with special relief from both the Privacy Act 
and the Access to Information Act. While boards and agencies may some- 
times find it administratively inconvenient to operate under the 
openness provisions of both laws, they are “there to protect Canadians, 
not bureaucrats and appointees”, the Commissioner told the commit- 
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tee. He urged the committee not to let individuals or institutions 
craft their own little set-asides and exemptions from laws such as the 
Privacy Act. 


Of greater immediacy, perhaps, was that this very issue is before the 
Courts. A man complained to the Commissioner of being denied 
access to personal information in the notes of the CLRB member 
who heard his case. The Board argues that members’ notes are not 
under CLRB control. The Commissioner considered the complaint 
well founded and appealed the Board’s continuing refusal to the Court. 
He urged the Committee to await the Court’s ruling before proceed- 
ing on this amendment. | 


As we go to press, the bill has received Royal Assent. The legislation 
now gives the Board the power to order employers to provide names 
and addresses of off-site workers to unions. The order must specify the 
method of communication, times of day and periods during which 
the communication is authorized and the conditions which must be 
met to safeguard the employees’ privacy. If the Board considers that 
employees’ privacy and safety cannot otherwise be protected, it may 
seek their consent for the disclosure. The weakness of this solution is 
that it acknowledges the privacy issue at stake, but resolves it by 
giving discretion to the Board to make the privacy determination 
for the employee. ? 


Parliament also rejected the recommendation to await the court’s deci- 
sion on access to Board members’ notes. Not only may these be 
accessed only with the member’s consent, the exemption is extended to 
anyone appointed by the minister and the Board to help in resolving 
complaints or issues 1n dispute before the Board. 


Canada Pension Pian Act 


Among extensive amendments to the Canada Pension Plan Act, were 
several dealing with access to, and disclosure of, individuals’ personal 
information in pension files. In an effort to loosen the stringent protec- 
tion provided this information by existing Canada Pension and Old 
Age Security legislation (which Human Resource Development 
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Canada —- HRDC — argued hampered its internal operations), it pro- 
posed substantially broader discretion for the Minister and greatly 
expanded permissible collection, uses and disclosures. 


The bill also contained a sort of truncated — and flawed — Privacy Act 
which appeared to hedge individuals access rights and built in no noti- 
fication to the Privacy Commissioner for public interest disclosures. 


The greatest danger in this approach is that clauses dealing with disclo- 
sures of personal information in other acts of Parliament override the 
specific limitations in the Privacy Act. In short, in the interest of achiev- 
ing greater flexibility in its own enabling legislation, the department 
risked gutting the Privacy Act. The Commissioner acknowledged that 
while that may not have been the intent, it was indeed the effect. He 
recommended HRDC require that any uses and disclosures be “consis- 
tent with” the original purpose for collection rather the blanket 
permission allowing the Minister to disclose “for the administration of 
another federal law, a provincial law or an activity”. The Commissioner 
suggested the department consider the approach taken in the Income 
Tax Act which sets out the limited and specific disclosures allowed. 


The bill allowed similarly broad collection from federal and provincial 
governments, their public bodies and non-government bodies without 
any attempt to limit the collection to information relevant to adminis- 
tering the CPP, or even to any HRDC program. 


Following several meetings, and on the eve of the Commissioner’s 
scheduled appearance before the Standing Committee on Finance, 
HRDC and Of fice staff negotiated several amendments. These included 
making it clear in law that individuals retain all existing Privacy Act 
rights, limiting sharing with federal institutions to those required to 
administer the CPP Act, removing references to provincial “activities” 
as legitimate for disclosures, and including specific references to non- 
HRDC programs which require CPP data to administer programs. 
Similar changes were made to the Old Age Security Act proposals. 


As in any negotiation, no-one got everything they wanted, but all got 
something they could live with. We commend HRDC staff for their 
sensitivity to their clients’ privacy and their determination to do the 


drafting properly. 
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Task Force on the Future of Financial Institutions 


The Task Force was created to examine the structure and policy issues 
surrounding the financial institutions and non-traditional providers of 
financial services. It is expected to report in September 1998. 


The Commissioner made his first submission to Parliament about pro- 
tecting the privacy of customer records in 1992 when new legislation 
changed the whole regulatory scheme for financial institutions. The 
report discussed the privacy threats posed by newly permitted cross- 
ownership of financial services. These include sharing customers’ 
personal information among affiliated institutions, as well as the tech- 
nological capacity these institutions have to collect and assimilate the 
personal data and profile their customers. 


In this report and subsequent submissions to Parliamentary 
Committees, the Commissioner recommended the government act on 
its power to make regulations to protect customer records. In the 
meantime, financial institutions have entered yet another line of busi- 
ness — processing other companies’ data. 


The upshot of several committee hearings and reports was to write 
regulations requiring financial institutions to establish procedures gov- 
erning the collection, retention, use and disclosure of customer 
information, to inform customers of these procedures, to appoint an 
internal officer to deal with complaints, and report annually on the 
complaints — all steps the industry had already taken. The Canadian 
Bankers Association has implemented the Canadian Standards 
Association Model Code and appointed an industry ombudsman. 


While this appears to be progress, two essential ingredients are missing: 
actionable rights and independent oversight. Nothing requires a finan- 
cial institution to open its doors to independent arbitration or audit. 
Without these components there is merely a mirage of privacy protec- 
tion. Six years labour seemed to have brought forth a mouse. 


Hope for effective privacy protection in financial institutions now rests 
on an effective law for the federally-regulated private sector, promised 


for the year 2000 (see page 11). 
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Updates 


Private Phone Directories: the End of the Saga 


As previous annual reports have demonstrated, subscribers’ personal 
information as published in telephone company directories, is worth its 
weight in gold. But, happily, subscribers have won back some control 
over this information. 


Four years ago, independent directory publisher White Directories of 
Canada asked telephone companies for their customer databases in 
order to publish its own directories. The Canadian Radio-Television 
and Telecommunications Commission (CRTC) agreed on condition 
that subscribers’ consent be sought. White Directories appealed the 
CRTC decision to the Governor-in-Council arguing that this could 
make White’s directories less complete. The Governor-in-Council 
agreed with White but ordered the CRTC to examine the broad pri- 


vacy protection of subscribers’ personal information. 


In December 1996, the CRTC reported back to the Governor in 
Council, acknowledging the privacy problems and signalling its intent 
to hold public hearings on the whole issue of opting out of directory 
listings. Among the Commissioner’s recommendations to last Fall’s 
hearings was one suggesting that the CRTC examine the cost of being 
unlisted which — at more than five dollars monthly in some provinces 
— was a deterrent to some who might otherwise choose to opt out. 


In its Order 98-109 (February 1998), the CRTC set a maximum 
monthly charge of two dollars for unlisted service and ordered tele- 
phone companies to allow subcribers to pay in installments any charges 
for changing their numbers. The CRTC rejected the Commissioner's 
other recommendations that unlisted service be free and, for the fourth 
time, that unlisted subscribers have automatic line blocking to prevent 
their number’s display. This refusal means that unlisted subscribers must 
remember to dial *67 (or 1167 for rotary dials) every time they call. 


Although less than we hoped, this latest order may help reenforce sub- 
scribers’ privacy by bringing unlisted charges within reach of more 
who may be interested. But don’t let down your guard yet. Everyone 
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should read carefully the introductory pages of the local telephone 
directory which explains the company’s special services and how they 
affect privacy. Too few people take the time to learn about how to 
remove their names from paper directories, call display, electronic 
directories on Internet (such as Canada411) and lists sold to marketing 
companies. 


Ten minutes spent reading may help prevent some of those annoying 
carpet cleaning solicitations at dinnertime, or stem the tide of junk 
mail in our mailboxes. 


Permanent Electors Register 


Elections Canada continues to keep the Office abreast of its adminis- 
tration of the permanent voters’ list. The list, created for the last federal 
election from a final enumeration, can be updated from citizenship and 
income tax databases with individual’s consent, and from various 
provincial sources. 


The Elections Act also allows Elections Canada to enter agreements to 
~ share lists of local voters with provinces and municipalities to help 
them draw up lists for local elections — providing individual voters 
consent. These lists (minus names of those who did not consent) have 
already been given to several provinces and municipalities which have 
signed agreements with Elections Canada. 


Shortly after lists were given to the New Brunswick and Winnipeg 
governments, several voters wrote to Elections Canada to opt out. 
Since it was too late to remove the names from the federal list, 
Elections Canada asked both governments to remove the names from 
local lists if the federal list was their only source. 


Given that this was in itself a disclosure of personal information, but 
one that is consistent with individuals’ exercising consent, Elections 
Canada also advised that it would amend its description of the bank in 
Info Source to make clear the possible disclosures. | 


Elections Canada has assured the Commissioner that all future agree- 
ments will include clauses requiring other levels of government to 
comply with these requests (existing agreements will also be amended). 
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On another note, the project to seek taxpayers’ consent for updating 
the electoral list from their income tax files appears to have succeeded. 
Despite some early nervousness, about 81 per cent of taxfilers agreed to 
the transfer — an indication that informed consent does work. 


Incidents 


The Canadian Wheat Board alerted the Commissioner 1n early March 
1998 that an MP and the Canadian Farm Enterprises Network had 
given the media a list containing exact salaries of all Board staff and 
members. The list included all staff, management and Governor-in- 
Council appointees — some 400 people. While the Privacy Act allows 
some information about employees to be released — specifically 
exempting it from the definition of “personal information” in the 
interest of public accountability — exact salaries are protected. 


Apparently the list was drawn up annually until 1996 to place new staff 
in the appropriate salary range according to their experience and quali- 
fications, and the range of existing employees doing the same work. 
Senior management also used the list during annual performance 
reviews to ensure consistency across the organization. Access to the list 
was tightly controlled to two senior executives and their secretaries, the 
person who prepared the list and another who analysed it for reports 

to senior management, and the director general of personnel. 


The Board confirmed that the list in the hands of an MP and the 
Canadian Farm Enterprises Network 1s a copy of the original. Given 
the intense political debate in Western Canada over Board staff salaries 
and its mandate, the disclosure was likely the classic plain brown enve- 


lope leak. 


The Board has hired a private company to investigate and will keep the 
Office informed as investigation progresses. It will also provide a copy 
of the investigation report. The Commissioner agreed to await the out- 
come of that investigation but reserves the right to make his own 
inquiries. 
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“Sharing agreements” become visible 


Virtually all privacy legislation contains clauses allowing governments 
to share information to administer or “enforce” various benefit pro- 
grams. While some sharing is understandable, its extent is 
mushrooming. Much of it is virtually invisible to a public not regular 
readers of the Canada Gazette or other arcane government publications. 
And Info Source, the federal government’s directory of personal infor- 
mation holdings, describes sharing in very general terms. 


Sharing is not confined to the federal government, of course. In fact, 
data is often shared among federal, provincial, municipal — and some- 
times even international — governments. The Privacy Act allows sharing 
“under an agreement or arrangement” to administer or enforce any law 
or carry out a lawful investigation. These agreements do not require 

the individuals’ consent and, although they oblige the government to 
advise the public, notice usually appears only in Info Source. 


Clear notification can have interesting consequences. A recent example 
is a provincial sharing agreement which, once spelled out for the pub- 
lic, unleashed a firestorm of criticism in British Columbia. When new 
legislation came into force in April 1997, the BC Ministries of Human 
Resources (MHR) and Education Skills and Training (MEST) wrote to 
those receiving Income Assistance, Youth Works and Disability benefits. 
The letter advised that recipients were “required to consent” to the 
ministries collecting information about them from various other orga- 
nizations. The operative paragraph reads: 


“I give my permission to any person having such rele- 
vant information or documents to release them upon 
written or verbal request to employees of MHR or 
MEST. I understand examples include, but are not 
restricted to, information or documents from: Human 
Resources Development Canada, Workers 
Compensation Board, Insurance Corporation of British 
Columbia, British Columbia Student Assistance 
Program, Motor Vehicle Branch, British Columbia 
Assessment Authority, Registrar of Companies, Land 
Titles, Lottery Corporation of British Columbia, Vital 
Statistics, Old Age Security, Canada Pension Plan, 
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federal, provincial or municipal government depart- 
ments, and the Department of Citizenship and 
Immigration Canada, police, federal or state related aid 
agencies from the United States of America or any 
other country, Equifax, any bank, credit union, cheque 
cashing service or other financial institution, any land- 
lord, and past, present or future employers of myself or 
my family members.” 


A separate box authorized Revenue Canada to disclose “income tax 
returns and other taxpayer information”. 


Astonishing as the list is, it may well be the first forthright description 
by any government of the scope of its information collection to police 
social programs. Collection on this scale would not have been possible 
without the advent of powerful information systems which match data 
from one system to another, usually by exchanging computer tapes. 


Shortly after the letters went out, the Office’s telephones began ring- 
ing. Given the scope and the lack of specifics on what was to be 
collected from the federal departments —- Human Resources 
Development Canada (HRDC) and Citizenship and Immigration 
(C&I), Office staft asked for details. 


HRDC reviewed the form and alerted its BC Region staff that “The 
form is not acceptable for the disclosure of information held by 
HRDC as it fails to provide sufficient facts to allow individuals to 
make an informed decision to consent or to refuse’. The department 
will continue releasing specific information under a long-standing 
agreement with the MHR. Information is shared to ensure that appli- 
cants are not drawing both employment insurance and welfare, or that 
their benefits are adjusted accordingly. 


All the information is drawn from the (Un)employment Insurance 
Claim File, Record of Employment File and/or Benefit and 
Overpayment Master File. It includes name and last known address, 
Social Insurance Number, case identification and various details on 
when benefits were begun, the weekly rate, claim status and type, wait- 
ing period and previous occupation. HRDC may also provide other 
details “for investigative purposes” on “written request”; however, these 
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disclosures require Headquarters’ authorization. Any disclosures to 
MEST require the individual’s consent. 


Citizenship and Immigration Public Rights staff faxed an advisory to 
its BC staff, reminding them to release personal data to MHR only in 
accordance with the 1997 Memorandum of Understanding. The mem- 
orandum sets out clearly what information may be released, how and 
when, and overrides any individual’s signed consent form. The Office is 
investigating several formal complaints against Revenue Canada. 


Apparently the proposed collection was discussed with BC Information 
and Privacy Commissioner David Flaherty who reviewed the legisla- 
tion and sharing agreements. Despite his concern, he had to conclude 
that the ministry had the “legislative authority to contact any agency 
that it considers necessary in order to verify eligibility for benefits”. Dr.’ 
Flaherty was instrumental in having the application and consent forms 
spell out the details, thus making it “transparent’’. 


In a public statement (issued January 27, 1998), he observed “That data 
collection is sanctioned by law does not in any way lessen its negative 

_ privacy impact on those receiving benefits. However my power 1s 
effectively limited by the fact that the Legislature can invade personal 
privacy by law or regulation, if this is determined to be in the public 
interest’’. 


Several anti-poverty groups launched a legal action against the collec- 
tion. In the face of the controversy, the MHR has revised the consent 
form, which is now an integral part of the application form, issued a 
fact sheet and a series of questions and answers on the benefits process 
for applicants. 
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Data Matching 


The sparse data matching activity in the past year has been limited to 
Human Resources Development Canada (HRDC). While other insti- 
tutions sent out feelers, often in the form of general questions on the 
process, once the whole approval procedure 1s explained — detailed 
assessments, cost benefit analysis and submission to the Privacy 
Commissioner — departments realize that this 1s no trivial matter. 
Sometimes the enquiries indicate more a need to understand data- 
matching rather than an intent to undertake one. 


Canada Student Loan defaulters and 
the government employee database 


_ This match, first described in last year’s annual report, proposed run- 
ning the list of those in default of their Canada Student Loans against 
the federal employee paylist. This would allow HRDC to identify those 
employees who have defaulted on loan repayment agreements and to 
recover any funds owed by an essentially captive audience. 


The Privacy Act clearly permits disclosures of personal data to locate 
someone who has been established as owing a debt to the Crown or to 
whom the Crown owes money. This 1s distinct from matching lists in 
order to determine who might owe a debt, as in the match of Customs 
traveller declarations and employment insurance claimants. This is an 
important distinction. 


Once the student loan program generated a list of defaulters and 
matched it with the government payroll, the Office’s lingering concern 
was to ensure that recovering any debt not have negative impact on 
the employee at work. Unless it becomes necessary to garnish the 
employee’s wages, the employer need not know that an employee 

has defaulted — it is a matter between employees and the Student 
Loan Program. 


HRDC explained that it would contact only one officer in the 
employing institution — the official in charge of the paylist. Collection 
officers would try to obtain the employee’s home address and tele- 
phone number and then deal with the employee at home. If a 
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satisfactory repayment plan can be worked out, the employer is not 
involved any further. Should garnishment prove necessary, arrangements 
will be made with the pay office, not the employee’s supervisors. 


Alberta Disability Income Program and CPP Disability benefits 


This match compares the list of beneficiaries of the Canada Pension 
Plan (CPP) disability plan with those receiving payments from the 
Alberta Disability Income Program. Although currently limited to 
Alberta, HRDC is planning similar arrangements with the other 
provinces and territories. 


The initiative, on the back burner for the past two years, 1s partly a 
response to a comment in the 1996 Report of the Auditor General. That 
report cited a 1995 Statistics Canada study showing that 17 per cent of 
those receiving CPP disability benefits were also receiving provincial 
Workers’ Compensation Board benefits. The Auditor General estimated 
that CPP could save $42 million annually by eliminating the duplicate 
payments. Curiously, this statement overlooks CPP’s status as the first 

- payer. Collateral benefits from the province do not usually affect enti- 
tlement to CPP disability benefits. This data match 1s more likely to 
produce savings for the Alberta program, not CPP. 


Alberta provides HRDC a list of those receiving payments from its 
program (part of the Workers Compensation plan). HRDC matches 
the information with its CPP disability payments database, creates a list 
of those appearing on both databases and gives it to Alberta. 


Although some individuals do legitimately receive benefits from both 
CPP disability and the Alberta program, many will find the Alberta 
payment reduced or eliminated. Only those suffering a prolonged dis- 
ability will receive a CPP disability pension. In the interim, Alberta 
may pay the provincial disability benefit. Once CPP payments kick in, 
provincial benefits may be adjusted or terminated. Alberta may recover 
any overpayments and will almost certainly benefit by reducing pro- 
gram costs. 


HRDC stated that matching two income replacement/support pro- 
erams —~ CPP Income Security and the Alberta program — ‘1s a 
“consistent use” of the CPP disability information. The Office accepts 
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that using information about an individual receiving an income 
replacement pension to assess eligibility for, and amount of, collateral 
benefits can be considered a consistent use of the information. 


To ensure a consistent approach at both ends, Office staff discussed the 
match with the Alberta Information and Privacy Commissioner’s 
office. That office had reviewed the match with the provincial ministry 
and decided not to intervene. However, if the match becomes routine, 
the Alberta commissioner will seek a clear statement on the provincial 
application form telling individuals that the information would be 
shared with CPP Income Security. 


We concluded that HRDC’s agreement with Alberta is authorized by 
both the Canada Pension Plan Act and can be argued is consistent with 
the original use under the Privacy Act. However, two further steps need 
to be taken — particularly if the program 1s to be expanded to other 
provinces. HRDC should alert Treasury Board to the new match in the 
descriptions of its personal information banks in Info Source. And 
HRDC should inform applicants for CPP disability benefits that it will 
advise provincial income replacement programs of their CPP disability 
status and benefits. 


Notifying Old Age Security of claimants’ deaths 


Another proposed match will use the Quebec Pension Plan (QPP) 
database to identify which federal Old Age Security claimants have 
died. Although HRDC’s Income Security Program receives death 
information from the Quebec vital statistics agencies, the information 
is not in a standard format and often does not include the SIN. 
Identifying the correct individual can be difficult. 


In all other provinces, residents contribute to the Canada Pension 

Plan and a death notice to either the OAS or CPP program is 
communicated to the other. Even though Quebec admunisters its 

own plan, heirs and administrators of estates may assume that notifying 
QPP is sufficient to notify the federal program. This is not so and 
HRDC has many examples of cheques continuing to be paid after — 
the beneficiary’s death. 
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The match is not yet underway; HRDC 1s in the final stages of draw- 
ing up a data sharing agreement with the Québec Régie des rentes 
which administers the QPP. 


Sharing names of OAS claimants and QPP recipients 


A somewhat related match would allow HRDC and QPP to match 
information about QPP recipients and applicants for Old Age Security, 
Guaranteed Income Supplement and the Spousal Allowance. Since the 
federal programs are linked to income, failing to declare income from 
QPP could give some applicants more than their entitlement. 


HRDE ran pilot studies in 1994 and 1996 using the CPP database 
which identified significant overpayments of the federal benefits to 
applicants who had misstated or not declared their CPP income. 
HRDC has no reason to believe that the situation would be any differ- 
entin Quebec ‘but, since 1t does not have. access to OPP data, camnet 


check. 


The match was under consideration at the end of the reporting year. 
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In the Courts 


Reference to the Federal Court by the Privacy Commissioner 
of Canada and the Attorney General of Canada 


Last year’s annual report signalled our intention to seek the Court’s 
guidance on the legality of government matching of returning trav- 
ellers’ Customs declarations with the Employment Insurance database. 
The case has now been filed. 


The Court will be asked two questions. The first 1s whether the 
Customs Act overrides government’s obligation in the Privacy Act to use 
personal information only for the purpose for which it 1s collected, 
unless the individual consents. The second asks whether searching every 
returning traveller on suspicion of defrauding Employment Insurance 
offends the “reasonable search and seizure” provision of the Canadian 
Charter of Rights and Freedoms. 


The Office had accepted a pilot project in order for Human Resources 
Development Canada (HRDC) to gather data for a formal data match- 
ing proposal to the Commissioner (required by Treasury Board 
culdelines). When HRDC moved to implement the project before his 
review was completed (and without his suggested safeguards), the 
Commissioner sought legal advice. 


The Court will be asked to consider the relationship between the 
Customs Act and the Privacy Act by way of a stated case (a statement of 
facts on which both the Privacy Commissioner and the government 
agree) under section 17(3) of the Federal Court Act. The question of 
whether the match offends the Charter is expected to be heard 
through an appeal of a complainant’s case to an umpire under the 
Employment Insurance Act. 


The Court is expected to consider the matters this Fall. 
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Robert Lavigne v. The Office of 
the Commissioner of Official Languages 


The Privacy Commissioner intervened in this application to support 
Mr. Lavigne’s request for access to his personal information. Mr. 
Lavigne wanted to examine certain witness statements and interview 
notes contained in the investigative files the Office of the 
Commissioner of Official Languages compiled while looking into his 
complaint against Human Resources Development Canada. 


Official Languages refused access, arguing that disclosure of this infor- 
mation would harm its enforcement of the Official Languages Act (an 
exemption permitted by s. 22(1)(b) of the Privacy Act). Official 
Languages had relied on provisions in its own legislation — the Official 
Languages Act — which deal with the confidentiality of information 
obtained during an investigation. 


At issue is the proper interpretation of s. 22(1)(b) of the Privacy Act and 
whether the right in the Privacy Act to see what others have said about 
you overrides the confidentiality of investigations under the Official 
Languages Act. 


The case will be heard on October 5, 1998. 


Privacy Commissioner v. Immigration and Refugee Board 


The Privacy Commissioner launched this application with the consent 
of an individual seeking access to his personal information contained in 
interview notes. An investigator, hired by the Board to conduct an 
internal review of several leaks to the media, had interviewed a number 
of employees and promised them confidentiality. 


The Board refused to provide the information to the individual, citing 
s. 22(1)(b) of the Privacy Act (see above). The Board argued that provid- 
ing access would impede its ability to conduct similar investigations in 
the future. 


In his reasons for judgement released on December 24, 1997, Mr 
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Justice Richard concluded that the Board “did not have reasonable 
grounds to withold disclosure of the records sought in this case”. He 
held that the Board’s claim of injury was “speculative” and there was 
“no evidence of probable harm to any investigation that has been 
undertaken or is about to be undertaken”. He concluded that “one 
cannot refuse to disclose information under s. 22(1)(b) on the basis 
that the disclosure will have a chilling effect on possible future 
investigations’. 


He ordered the Board to give the individual the personal information 
at issue. 


The Charter — 
A Reasonable Expectation of Privacy 


In the Beginning 


Despite the lack of a specific right to privacy in the Canadian Charter of 
Rights and Freedoms, Canada’s highest Court has recognized privacy as a 
constitutionally protected or Charter value almost from the beginning. 


Several provisions in the Canadian Charter protect privacy values: sec- 
tion 2 protects individuals’ abilities to decide personal beliefs and 
opinions; section 10, the right to legal counsel; sections 11 and 13, the 
right against self-incrimination. These rights protect informational pri- 
vacy by controlling the way information 1s collected and used. 

Section 7 provides a right not to be deprived of life, liberty and securi- 
ty of the person, except in accordance with the principles of 
fundamental justice. This is at least suggestive of privacy protection. 
But it 1s section 8 of the Charter — the protection against unreason- 
able search and seizure — which has been the most valuable for 
privacy advocates. It’s worth examining some Supreme Court of 
Canada decisions because they can provide tools for advancing privacy 
as human right. 
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Some Key Cases 


In Hunter v. Southam Inc.', the Supreme Court stated that a major 
purpose of the constitutional protection against unreasonable search 
and seizure under section 8 of the Charter of Rights and Freedoms was 
the protection of the privacy of the individual. The case involved a 
constitutional challenge to a search conducted under the Combines 
Investigation Act. The Court concluded that to assess the constitutionali- 
ty of a search, it must focus on the search’s reasonableness or 
unreasonableness in terms of its impact on the individual and not sim- 
ply on its rationality in furthering a valid government objective. Mr. 
Justice Dickson of the Supreme Court advanced in this case for the 
first time the notion of “reasonable expectation of privacy” as a stan- 
dard against which government action should be scrutinized. He made 
it clear that the expectation of privacy was at the forefront of any s. 8 
Charter analysis. He said: 


“The guarantee of security from unreasonable search and 
seizure only protects a reasonable expectation. This limitation 
on the right guaranteed by s. 8 whether it is expressed nega- 
tively as freedom from ‘unreasonable’ search and seizure, or 
positively as an entitlement to a ‘reasonable’ expectation of pri- 
vacy, indicates that an assessment must be made as to whether 
in a particular situation the public’s interest in being left alone 
by government must give way to the government’s interest in 
intruding on the individual’s privacy in order to advance its 
goals, notably those of law enforcement”. 


The notion of reasonable expectation of privacy deserves some exami- 
nation. There is no definition by the Court (or of course, in the 
Charter). Rather, it is to be determined on the basis of the totality of 
the circumstances. The American Courts have suggested some guide- 
lines as follows: 


“(i) presence at the time of the search; 
(ii) possession or control of the property or place searched; 
(iii) ownership of the property or place; 


(iv) historical use of the property or item; 


92 


(v) the ability to regulate access, including the right to 
admit or exclude others from the place; 


(vi) the existence of a subjective expectation of privacy; and 
(vii) the objective reasonableness of the expectation.” ” 


These factors are not particularly protective of privacy. The Canadian 
Court has tended to be more flexible in its approach to what consti- 
tutes an unreasonable invasion of privacy. It has found that a person’s 
expectation of privacy 1s very high in one’s own home (but lower in 
someone else’s home) and not so very high in the workplace’; high in 
hair and saliva samples and teeth impressions but not in the mucous 
thrown away on a tissue*; higher in private phone calls than pay phone 
calls° and high in private records such as medical or therapeutic 
records, school records, private diaries®. The driver of a vehicle has 
more expectation of privacy than a passenger and the expectation is 
higher in a tagged suitcase than a plain garbage bag ’. 


In R. v. Stewart*, a union seeking to organize hotel employees hired 
Mr. Stewart to obtain their names, addresses and telephone numbers. 
Mr. Stewart contacted the hotel security guard and offered to purchase 
the information. The guard refused, knowing he was not authorized to 
access that information through the hotel records and that the hotel 
had previously refused to give the information to the union. 

Mr. Stewart was charged with counselling to commit fraud and theft. | 
After an acquittal at trial, the Court of Appeal entered a conviction on 
the charee, 


The Supreme Court allowed the appeal on the basis that confidential 
information does not qualify as property, at least for the purposes of the 
Criminal Code and that Mr. Stewart’s conduct did not amount to fraud 
as it did not involve a risk of economic loss amounting to deprivation. 
(But that’s not the important part.) Cory J.A., as he then was, suggested 
that information and its collection, collation and interpretation are so 
vital to modern enterprises that it may be considered their most valu- 
able asset. He then concluded that the confidential or private nature of 
the information is exactly what gives it its proprietary interest. Picking 
up on that theme, Mr. Justice Lamer, (now Chief Justice) acknowledged 
that, “... given recent technological developments, confidential informa- 
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tion, and in some instances, information of a commercial value, is in 
need of some protection” but he considered that this was best left to 
Parliament. 


Some six months later, Mr. Justice Lamer had an opportunity to revisit 
these notions in R. v. Dyment?. In that case, decided before amend- 
ments to the Criminal Code dealing with blood samples, a doctor drew 
a blood sample from an emergency patient without his consent or 
knowledge in order to provide medical treatment and later gave it to a 
police officer for his investigation. The sample was used to secure a 
conviction of impaired driving. Mr. Justice Lamer found that the blood 
was held by the doctor subject to a duty to respect the patient’s priva- 
cy; and Mr. Justice La Forest found that the officer breached the 
respondent’s privacy interests in the sample and so effected a seizure 
within the meaning of section 8 of the Charter of Rights. This case 1s 
often cited for identifying the three types of privacy: physical, territor- 
ial and informational. Actually, as the Court pointed out, these 
categories were first identified in a 1972 joint study by the Federal 
Department of Justice and the Department of Communications. The 
Court accepted that the notion of privacy derives from the assumption 
that all information about a person is in a fundamental way, his own. 


Two years later, in R. v. Duarte', Mr. Justice La Forest had occasion to 
review the police practice of “consent surveillance” i.e. electronic sur- 
veillance without a court authorization where one of the parties to a 
conversation, an undercover police officer, surreptitiously records it. He 
reinforced the precept that the Charter standard for privacy is set at a 
“reasonable expectation of privacy” and that the particular police prac- 
tice of audio-surveillance failed to meet that standard. 


That same year, Mr. Justice LaForest wrote the majority reasons in a 
case involving unauthorized videotape surveillance of a hotel room. In 
R. v. Wong'', he again stressed the need to interpret the individual’s rea- 
sonable expectation of privacy in light of the social importance of 
privacy. In other words, the question should always be framed in a neu- 
tral manner: whether in a society such as ours, persons who retire to a 
hotel room and close the door have a reasonable expectation of priva- 
cy. He considered that the Court must examine the reasonable 
expectation in the context of a free and democratic society - i.e. with- 
out reference to any illegal activity of the particular person. 
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Mr. Justice. Sopinka and Mr. Justice Lamer considered that the 

Court must evaluate the expectation in light of what a reasonable 
person placed in those circumstances could expect. For example, in 

R. v. Plant’, Mr. Justice Sopinka wrote the Court’s majority judgment 
examining the individual’s privacy interest in computerized utility 
records. 


In this case, Calgary Police received a tip that an individual was grow- 
ing maryuana in his house. They searched his electricity records held in 
the computer of the city’s utility commission, using a remote terminal 
in the police station with a password supplied by the utility. They dis- 
covered that the house used four times the average amount of 
electricity — but typical use for a marijuana operation. Eventually, the 
owner was charged and convicted. The matter went to the Supreme 
Court where it was argued that the warrantless search of the owner’s 
computerized records violated his reasonable expectation of privacy 
under section 8 of the Charter. 


The Supreme Court rejected the claim. Justice Sopinka set out five fac- 
tors for applying the reasonable expectation test: one must consider the 
nature of the information itself, the nature of the relationship between 
the party releasing the information and the party claiming its confiden- 
tiality, the place where the information was obtained, the manner in 
which it was obtained, and the seriousness of the crime being investi- 
gated. These factors, he felt, would properly allow for a balancing of the 
societal interest in protecting individual dignity, integrity and autono- 
my with effective law enforcement. Under the last factor, he concluded 
that the seriousness of the accused’s offence in this case suggested that 
the accused could not reasonably have a privacy interest which out- 
weighed the state’s interest in law enforcement. 


In a short but powerful dissent, Madame Justice McLachlin disagreed 
with the conclusion that police were free to search the database with- 
out a warrant. The proper question for her was whether the evidence 
disclosed a reasonable expectation that the information would be kept 
in confidence and used only for the purpose for which it was given. 
Electricity records, she said, were “close to the line” but they deserved 
protection because they could reveal information about the individual’s 
private life. She writes in her judgment: 
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“The records are capable of telling much about one’s personal 
lifestyle, such as how many people lived in the house and what 
sort of activities were probably taking place there. The records 
tell a story about what is happening inside a private dwelling, 
the most private of all places. I think the reasonable person 
looking at these facts would conclude that the records should be 
used only for the purpose for which they were made — the 
delivery and billing for electricity — and not to be divulged to 
strangers without proper legal authorization.” 


In a September 1997 speech entitled “Freedom of Speech and Privacy 
in the Information Age”, Mr. Justice Sopinka spoke of his approach in 
the Plant case: 


“In that case, we had to consider whether it was constitutional- 
ly permissible for the police to use its computer records of the 
electrical consumption at a specified address in order to deter- 
mine whether or not it was likely that marijuana was being 
grown at the house, since this is often characterized by a higher 
than normal consumption of electricity. I observed that the 
‘Charter should seek to protect a biographical core of personal 
information which individuals in a free and democratic society 
would wish to maintain and control from dissemination to the 
state’. It could be said that information revealing a pattern of 
electricity consumption would fall into such a category. 
However, each case must be decided on its own facts, carefully 
analyzing the extent to which respect for one’s personal privacy 
and dignity has been violated.” 


Justice La Forest has occasionally pursued privacy protection much fur- 
ther than the rest of the Court. In Edmonton Journal v. Alta (A.G.)”, 

the Court examined the rights of individuals to protect their privacy 
against the right of newspapers to report on court proceedings. At issue 
was a provision of the Alberta Judicature Act which limited the publica- 
tion of information relating to matrimonial cases. In his dissent, Justice 
La Forest concluded that, although freedom of expression and the need 
for open courts are important interests, the general publication of 
details of private family cases serves insufficient public interest and the 
limitation should stand. Most interestingly, in this case, it was recog- 
nized that the privacy of individuals is not only threatened by the 
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interference of government but also by other powerful entities, such as 
the media, against which an individual is powerless. 


Morte recently, the Court has extended the notion of privacy into that 
of reputation, perhaps opening the door to successful claims in damages 
for invasion of privacy. In Morris Manning and Church of Scientology of 
Toronto’, Mr. Justice Cory stated: 


sie reputation is intimately related to the right to privacy 
which has been accorded constitutional protection. As 

La Forest J. wrote in R. v. Dyment, ‘privacy, including infor- 
mational privacy, is [g]rounded in man’s physical and moral 
autonomy and is essential for the well-being of the individual’. 
The publication of defamatory comments constitutes an inva- 
sion of the individual’ personal privacy and is an affront to 
that person’s dignity. The protection of a person’s reputation is 
indeed worthy of protection in our democratic society ...” 


For the Future 


This notion that the Charter is concerned not only with protecting 
property but also protecting privacy could be an extremely valuable 
one. Speaking before the Canadian Human Rights foundation in 1990, 
Mr. Justice LaForest suggested that “it is with the adoption of section 8 
of the Charter that a privacy doctrine has truly developed’. However, 
as Mr. Justice Sopinka has more recently re-iterated on the subject, “... 
It [the Charter] only applies to government action. Given that much of 
the world of electronic communication 1s controlled privately, without 
any government regulation, the Charter may be an ineffective tool ...” 


Several cases could advance to the Supreme Court in which privacy 
will face off against, not only the historically competing interests like 
law enforcement, but also those of judicial independence and gover- 
nance issues. These will test the waters because they raise two interests 
which the Court has consistently protected. For example, there 1s what 
one privacy commissioner describes as a “high technology search and 
seizure” case. Last year’s annual report dealt with the case of the 
Customs E-311 computer data match. Human Resources Development 
Canada is matching the Employment Insurance data base with that of 
returning air travellers custom declarations. The “hit” shows who of 
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these millions of flyers has been receiving employment insurance pay- 
ments, possibly undeservedly. The match offends fundamental privacy 
principles by taking information given by Canadians for one purpose 
and, without their consent, using it for a very different purpose. 


It also violates privacy more fundamentally in that it fails to recognize 
the right of millions of innocent Canadians to be left alone by their 
sovernment if they have done nothing wrong. The Privacy 
Commissioner considers the program violates s. 8 of the Charter in 
that it erodes Canadians’ reasonable expectation of privacy and there- 
fore constitutes an unreasonable search and seizure of personal 
information. At time of writing, he expects, after months of complex 
negotiation with the Attorney General, to have the matter before the 
first level of courts in the Fall of 1998. 
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Privacy protection in Canada... an update 


The following highlights events in the provinces and territories since 
our last annual report. For a summary of the legal privacy protection in 
place in each jurisdiction, please check our Web site or call the Office. 


Parliament extended Privacy Commissioner Bruce Phillips’ term until 
May 2000. The federal government conducted public consultations 
on a proposed privacy protection law that would apply to the federal- 
ly-regulated private sector (see page 11). 


Alberta renewed Information and Privacy Commissioner Bob Clark’s 
appointment until 2002. As well, the provincial government will extend 
its Freedom of Information and Privacy Act to school boards (effective 
September 1, 1998), health care bodies (October 1, 1998), universities 
and colleges (January 4, 1999) and municipal governments and police 
commissions (October 1, 1999).The government’s Health Information 
Steering Committee, struck by the minister of health, is expected to 
report in July on a health information act to replace the bill tabled and 
withdrawn last year. The bill is expected to be debated 1n the Assembly 
in February 1999. Finally, the Freedom of Information and Protection of 
Privacy Act will undergo its statutory three-year review this summer. 


The British Columbia College of Physicians and Surgeons, the B.C. 
Medical Association and the provincial Information and Privacy 
Commissioner jointly developed a Privacy Code that now protects the 
confidentiality of personal information held in a doctor’s private office. 
And following an outcry over the intrusiveness of a provincial ministry 
of human resources consent form, the Commissioner’s office reviewed 
and advised on a replacement form and pamphlet (see page 82). The 
Commissioner’s office also reviewed a College of Pharmacists’ audit 
and inspection reports on use of Pharmanet, the province’s on-line 
drug prescription and billing system. 


Manitoba adopted two new laws to protect Manitobans’ privacy. The 
new Freedom of Information and Protection of Privacy Act, proclaimed in 
May 1998, replaces the 1988 Freedom of Information Act and expands 
provincial residents’ privacy rights to include controls on government 
bodies’ collection, use and disclosure of their personal data. As well, 
effective December 1997, the Personal Health Information Act (the first 


99 


such law in Canada), regulates the collection, use and disclosure of 
medical records. Both laws are overseen by provincial Ombudsman 
Barry Tuckett who has appointed former provincial archivist Peter 
Bower as executive director of the office’s new Freedom of 
Information and Protection of Privacy Division. 


New Brunswick passed its new Protection of Personal Information Act 
February 1998 (the law is not yet in force). The new Act applies to the 
provincial public sector and is the first in Canada based on the 
Canadian Standards Association’s Model Privacy Code. Responsibility 
for oversight was given to the provincial Ombudsman. In addition, the 
provincial justice minister announced his intention to “present a discus- 
sion paper soon considering the possible extension of privacy 
legislation to the private sector’. Public consultations are scheduled to 
take place in the summer of 1998. 


Despite calls for revamping the provincial Privacy Act (a tort law), 
Newfoundland and Labrador have made only minor amendments 
to that statute, and to the province's Freedom of Information Act, dealing 
with the disclosure of a person’s criminal history. 


Several Ontario initiatives will have an impact on individuals’ privacy. 
Students will now be assigned a unique ID number which will be used 
in place of their names to allow the Ministry of Education to track 
them throughout their schooling. New regulations will now impose 
certain restrictions on the search powers which currently allow social 
workers to search a welfare recipient’s house to verify eligibility. And 
social assistance recipients must now be identified using a biometric 
identifier — a digitized fingerprint. The provincial government is also 
working on a proposed Personal Health Information Protection Act that 
would regulate the collection, use and disclosure of medical informa- 
tion, which the government announced would pave the way to equip 
every Ontarian with a smart health card. The bill may be tabled in 
1998. And finally, the Legislature appointed former Assistant Privacy 
Commissioner Ann Cavoukian to replace outgoing Information and 
Privacy Commissioner Tom Wright who completed his term in 


April 1997. 
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Prince Edward Island remains the only province without privacy 
legislation. However, the government tabled a proposed Freedom of 


Information and Protection of Privacy Act (Bill 81) in November 1997, 
which awaits second reading in the Legislature. 


In the Fall of 1997, Québec’s National Assembly conducted public 
consultations on amendments to the province’s two key privacy protec- 
tion statutes; the 16-year old law governing the public sector, and the: 
five-year old law regulating private business. The National Assembly 
also tabled its final report on a provincial identity or multi-purpose 
card, recommending that no card be developed now for lack of a 
demonstrated need. However, it suggested that the government might 
consider an optional identification card for those wanting one. The 
provincial Privacy Commission embarked on a thorough review of the 
security and confidentiality mechanisms protecting provincial govern- 
ment databases in reaction to the well-publicized improper sale of 
Quebecers’ personal information by civil servants (who were later 
fired). As well, the Commission continues seeking controls on the 
extraordinary powers given to the provincial revenue ministry which, 
to wage its war against tax fraud, has been armed with the unchal- 
lenged right to access any personal information held by any public 
sector agency. 
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Corporate Management 


The Privacy and Information Commissioners share premises and 
administrative services while operating separately under their statutory 
authorities. These shared services — finance, personnel, information 
technology and general administration — are centralized in Corporate 
Management Branch to avoid duplication of effort and to save money 
for both government and the programs. The Branch has just 14 staff 
and a budget representing 14 per cent of total program expenditures. 


Resource Information 


The Offices’ total budget for the 1997-98 fiscal year was $6,616,000. 
Actual expenditures for 1997-98 were $6,440,099 of which, personnel 
costs of $5,308,203 and professional and special services expenditures 

of $695,181 accounted for more that 93 per cent of all expenditures. 
The remaining $436,715 covered all other expenditures including 
postage, telephone, office equipment and supplies. | 


Expenditure details are reflected in Figure 1 (resources by organiza- 
tion/activity) and Figure 2 (details by object of expenditure). 


Figure 1 


1997-98 Resources by Organization/Activity 


HUMAN RESOURCES FINANCIAL RESOURCES 
(Full-Time Equivalents) ($000) 


Privacy 
34 (43%) 


Privacy 
: 3,076 (48%) 


Administration SS intormation : Administration ~— | —— Information 


14 (18%) 31 (39%) : 893 (14%) ¥ 2,471 (38%) 


102 


Figure 2 


Details by Object of Expenditure 


| Comorte | ..., 
‘Management | 1 


Salaries 1,829,617 U0, 0/6,656 4,499,203 


‘Employee Benefit = = | a99qqq| 978 9 |. t / 
| Plan Contributions _ a oe ,000 | lL. - 108, 3,000 | - 809 000 


Transportation . a ot : 
and Communication ar : eae 389 4 1 AL 29, yee 210, ih 


petessonal a6 special eenicee 181, 559 ; 696, 181 

pircuased Ca oR ea Hie Pe See tapas : 
BGAN AR COMET) A ee. Se ae tk 21) WL 2 Partial 17, 21 

toe Materials and Supplies | ed 38 ot AZ AGR 2 25088 | 67 974 
Machinery and aa Out | a a 

Other Payments 


2.470,714| 3,075,974 393,411 | 6,440,099 


* Expenditure Figures do not incorporate final year-end adjustments 
reflected in the Offices’ 1997-98 Public Accounts. 
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Organization Chart 


Parliament 


Privacy Director General Information 
Commissioner Corporate Management Commissioner 
General Personnel Finance 
Counsel Deputy Information 
Commissioner 
Administration ; Informatics 
Executive Investigations Public y 
Director and Reviews Affairs 
Investigations Issues 
and Inquiries Management Legal 
Advisors 
Public Affairs 
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